erabo/spiegel-keyman
1
0
Fork 0
mirror of https://github.com/keymanapp/keyman.git synced 2026-08-11 19:35:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Merge pull request #1155 from keymanapp/developer-web-editor-security-backend

Browse source 
[Developer] Prevent web requests from breaking out of our root path with ../
This commit is contained in:
Marc Durdin 2018-09-04 13:42:32 +10:00 • committed by GitHub
commit 68154be506
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.App.pas
View file

@ -262,9 +262,9 @@ begin
end
else
begin
if Pos('..', doc) > 0 then
if IncludesParentFolderReference(doc) then
begin
// TODO: This is a naive security check. Need to expand
// Block paths that attempt to break out of our 'root'
Respond404(AContext, ARequestInfo, AResponseInfo);
end
else

7
windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.Base.pas
View file

@ -10,6 +10,7 @@ uses
type
TBaseHttpResponder = class
protected
function IncludesParentFolderReference(const path: string): Boolean;
procedure RespondFile(AFileName: string; AContext: TIdContext;
ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo);
procedure Respond404(AContext: TIdContext;
@ -25,6 +26,12 @@ uses
{ TBaseHttpResponder }
function TBaseHttpResponder.IncludesParentFolderReference(
const path: string): Boolean;
begin
Result := path.Contains('../') or path.Contains('..\');
end;
procedure TBaseHttpResponder.Respond404(
AContext: TIdContext; ARequestInfo: TIdHTTPRequestInfo;
AResponseInfo: TIdHTTPResponseInfo);