Canithesis/digFTP
4
0
Fork 0
Code Issues 2 Pull Requests Packages Projects Releases Wiki Activity

Fixed traversing through symlinks with external symlinks on

Browse Source
This commit is contained in:
Wirlaburla
2025-01-01 14:12:17 -06:00
parent 74a60e8977
commit 73d58b9f52
1 changed files with 7 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/plugins/filer_local/filer_local.cpp
View File

@@ -106,10 +106,7 @@ public:
if (fs::is_symlink(*target) && resolve_symlink) { if (fs::is_symlink(*target) && resolve_symlink) {
fs::path resolved_sym = fs::weakly_canonical(*target); fs::path resolved_sym = fs::weakly_canonical(*target);
logger->print(LOGLEVEL_DEBUG, "Resolved symlink path: %s", resolved_sym.c_str()); logger->print(LOGLEVEL_DEBUG, "Resolved symlink path: %s", resolved_sym.c_str());
if (!resolve_ext_symlinks) { return resolve_ext_symlinks ? true : resolved_sym.string().starts_with(root.string());
if (!resolved_sym.string().starts_with(root.string()))
return false;
} else *target = resolved_sym;
} else if (!(*target).string().starts_with(root.string())) } else if (!(*target).string().starts_with(root.string()))
return false; return false;
@@ -126,7 +123,7 @@ public:
struct file_data fd; struct file_data fd;
try { try {
fs::path requested_path; fs::path requested_path;
if (!resolvePath(dir, &requested_path)) { if (!resolvePath(dir, &requested_path, false)) {
fd.error = file_error{FilerStatusCodes::NoPermission, "Invalid Permissions"}; fd.error = file_error{FilerStatusCodes::NoPermission, "Invalid Permissions"};
return fd; return fd;
} }
@@ -148,18 +145,11 @@ public:
return fd; return fd;
} }
// Make sure path is within root directory
fs::path rel_path = fs::relative(requested_path, root);
if (rel_path.string().find("..") == 0) {
fd.error = file_error{FilerStatusCodes::NoPermission, "Invalid Permissions"};
return fd;
}
// Update current working directory relative to root // Update current working directory relative to root
cwd = "/" + rel_path.string(); cwd = "/" + fs::path(requested_path).lexically_relative(root).string();
fd.path = strdup(requested_path.c_str()); fd.path = strdup(requested_path.c_str());
fd.relpath = strdup(fs::relative(requested_path, root).c_str()); fd.relpath = strdup(fs::relative(requested_path, root).c_str());
} catch (const fs::filesystem_error& ex) { } catch (const fs::filesystem_error& ex) {
logger->print(LOGLEVEL_ERROR, "Path fallback: %s", ex.what()); logger->print(LOGLEVEL_ERROR, "Path fallback: %s", ex.what());
fd.error = file_error{FilerStatusCodes::Exception, ex.what()}; fd.error = file_error{FilerStatusCodes::Exception, ex.what()};
@@ -395,6 +385,8 @@ public:
char* line; char* line;
fs::perms fperms = fs::symlink_status(p).permissions(); fs::perms fperms = fs::symlink_status(p).permissions();
bool is_link = S_ISLNK(fstat.st_mode); bool is_link = S_ISLNK(fstat.st_mode);
std::string link_path;
if (is_link) link_path = fs::read_symlink(p).lexically_relative(root).string();
asprintf( asprintf(
&line, &line,
"%c%c%c%c%c%c%c%c%c%c %4u %4u %4u %12u %s %s%s\r\n", "%c%c%c%c%c%c%c%c%c%c %4u %4u %4u %12u %s %s%s\r\n",
@@ -414,7 +406,7 @@ public:
fstat.st_size, fstat.st_size,
timebuff, timebuff,
p.path().filename().c_str(), p.path().filename().c_str(),
is_link?(" -> " + fs::read_symlink(p).string()).c_str():"" is_link?(" -> " + link_path).c_str():""
); );
listStream << std::string(line); listStream << std::string(line);