extern/KasmVNC
1
0
Fork 0
mirror of https://github.com/kasmtech/KasmVNC.git synced 2024-11-21 15:43:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix dir traversal by percent-encoding dots

Browse Source
This commit is contained in:
Lauri Kasanen 2024-06-14 11:58:06 +03:00
parent 9f7a6b58ce
commit 4b18320984
No known key found for this signature in database
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
common/network/websocket.c
View File

@ -917,6 +917,12 @@ static void servefile(ws_ctx_t *ws_ctx, const char *in, const char * const user,
percent_decode(path, buf, 1);
// in case they percent-encoded dots
if (strstr(buf, "../")) {
handler_msg("Attempted dir traversal attack, rejecting\n", len);
goto nope;
}
handler_msg("Requested file '%s'\n", buf);
sprintf(fullpath, "%s/%s", settings.httpdir, buf);