From 300de9c89bb2c6d14e73d3c2baa73a40e49396eb Mon Sep 17 00:00:00 2001
From: Marc Durdin <marc@keyman.com>
Date: Tue, 4 Sep 2018 11:18:17 +1000
Subject: [PATCH] [Developer] Prevent web requests from breaking out of our
 root path with ../

---
 .../TIKE/http/Keyman.Developer.System.HttpServer.App.pas   | 4 ++--
 .../TIKE/http/Keyman.Developer.System.HttpServer.Base.pas  | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.App.pas b/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.App.pas
index 1beff18396..028fec7ee8 100644
--- a/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.App.pas
+++ b/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.App.pas
@@ -262,9 +262,9 @@ begin
   end
   else
   begin
-    if Pos('..', doc) > 0 then
+    if IncludesParentFolderReference(doc) then
     begin
-      // TODO: This is a naive security check. Need to expand
+      // Block paths that attempt to break out of our 'root'
       Respond404(AContext, ARequestInfo, AResponseInfo);
     end
     else
diff --git a/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.Base.pas b/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.Base.pas
index 60d7e969c4..692fba5fc5 100644
--- a/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.Base.pas
+++ b/windows/src/developer/TIKE/http/Keyman.Developer.System.HttpServer.Base.pas
@@ -10,6 +10,7 @@ uses
 type
   TBaseHttpResponder = class
   protected
+    function IncludesParentFolderReference(const path: string): Boolean;
     procedure RespondFile(AFileName: string; AContext: TIdContext;
       ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo);
     procedure Respond404(AContext: TIdContext;
@@ -25,6 +26,12 @@ uses
 
 { TBaseHttpResponder }
 
+function TBaseHttpResponder.IncludesParentFolderReference(
+  const path: string): Boolean;
+begin
+  Result := path.Contains('../') or path.Contains('..\');
+end;
+
 procedure TBaseHttpResponder.Respond404(
   AContext: TIdContext; ARequestInfo: TIdHTTPRequestInfo;
   AResponseInfo: TIdHTTPResponseInfo);