erabo/spiegel-keyman
1
0
Fork 0
mirror of https://github.com/keymanapp/keyman.git synced 2026-08-09 18:35:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(developer): handle utf-8 paths safely

Browse source
This commit is contained in:
Marc Durdin 2022-11-10 15:26:27 +11:00
parent 0f2fbd443d
commit 31513d657e
3 changed files with 27 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
common/windows/delphi/web/Keyman.System.HttpServer.Base.pas
View file

@ -23,6 +23,8 @@ type
AResponseInfo: TIdHTTPResponseInfo);
end;
function CrackUTF8ZeroExtendedString(const p: string): string;
implementation
uses
@ -30,6 +32,25 @@ uses
System.SysUtils;
function CrackUTF8ZeroExtendedString(const p: string): string;
var
s: RawByteString;
i: Integer;
begin
// Indy's UTF8 handling of URLs is *completely* broken.
// We may need to check this with updated versions of Delphi
{$IFNDEF VER330}
ERROR! Check if this is still needed with Delphi update
{$ENDIF}
SetLength(s, p.Length);
for i := 1 to p.Length do
begin
s[i] := AnsiChar(Ord(p[i]));
end;
Result := UTF8ToString(s);
end;
{ TBaseHttpResponder }
function TBaseHttpResponder.IncludesParentFolderReference(

4
developer/src/tike/http/Keyman.Developer.System.HttpServer.App.pas
View file

@ -102,7 +102,7 @@ procedure TAppHttpResponder.RespondProject(doc: string; AContext: TIdContext;
Exit;
end;
path := UTF8ToString(AnsiString(ARequestInfo.Params.Values['path']));
path := CrackUTF8ZeroExtendedString(ARequestInfo.Params.Values['path']);
if (Path <> '') and (not FileExists(path) or not SameText(ExtractFileExt(path), Ext_ProjectSource)) then
begin
@ -132,7 +132,7 @@ procedure TAppHttpResponder.RespondProject(doc: string; AContext: TIdContext;
Exit;
end;
path := UTF8ToString(AnsiString(ARequestInfo.Params.Values['path']));
path := CrackUTF8ZeroExtendedString(ARequestInfo.Params.Values['path']);
if not FileExists(path) or (
not SameText(ExtractFileExt(path), '.ico') and

8
developer/src/tike/http/Keyman.Developer.System.HttpServer.AppSource.pas
View file

@ -96,7 +96,7 @@ begin
if ARequestInfo.Document = '/app/source/file' then
begin
// TODO: We should be passing a token to the browser for future POST security
Filename := UTF8ToString(AnsiString(ARequestInfo.Params.Values['Filename']));
Filename := CrackUTF8ZeroExtendedString(ARequestInfo.Params.Values['Filename']);
if ARequestInfo.CommandType = hcGET then
begin
@ -112,12 +112,12 @@ begin
else if ARequestInfo.Document = '/app/source/toucheditor' then
begin
// Respond files?
Filename := UTF8ToString(AnsiString(ARequestInfo.Params.Values['Filename']));
Filename := CrackUTF8ZeroExtendedString(ARequestInfo.Params.Values['Filename']);
RespondTouchEditor(Filename, AContext, ARequestInfo, AResponseInfo);
end
else if ARequestInfo.Document = '/app/source/toucheditor/state' then
begin
Filename := UTF8ToString(AnsiString(ARequestInfo.Params.Values['Filename']));
Filename := CrackUTF8ZeroExtendedString(ARequestInfo.Params.Values['Filename']);
RespondTouchEditorState(Filename, AContext, ARequestInfo, AResponseInfo);
end
else if ARequestInfo.Document.StartsWith('/app/source/toucheditor/lib/') then
@ -147,7 +147,7 @@ begin
end
else if ARequestInfo.CommandType = hcPOST then
begin
FData := UTF8ToString(AnsiString(ARequestInfo.Params.Values['State']));
FData := CrackUTF8ZeroExtendedString(ARequestInfo.Params.Values['State']);
RegisterSource(AFilename + '#state', FData, True);
end;
end;