Merge pull request #70 from maxnet/master

httpd: disallow directory traversal

Merge pull request #70 from maxnet/master
httpd: disallow directory traversal
10710949 · Christian Beier · f5abd4ab · f5ae9463 · 10710949
Commit 10710949 authored Apr 17, 2015 by Christian Beier
Show whitespace changes
Inline Side-by-side

Showing with 8 additions and 0 deletions

httpd.c libvncserver/httpd.c +8 -0

No files found.
--- a/libvncserver/httpd.c
+++ b/libvncserver/httpd.c
@@ -423,6 +423,14 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen)
       }
    }

+    /* Basic protection against directory traversal outside webroot */
+
+    if (strstr(fname, "..")) {
+        rfbErr("httpd: URL should not contain '..'\n");
+        rfbWriteExact(&cl, NOT_FOUND_STR, strlen(NOT_FOUND_STR));
+        httpCloseSock(rfbScreen);
+        return;
+    }

    /* If we were asked for '/', actually read the file index.vnc */