Mercurial Hosting > luan

comparison src/luan/host/WebHandler.java @ 1174:bdf27aa2a65c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix luanhost security bug
author Franklin Schmidt <fschmidt@gmail.com>
date Sun, 11 Feb 2018 17:13:40 -0700
parents d30d400fd43d
children
comparison
equal deleted inserted replaced
1173:bdbd1d12c1f2 1174:bdf27aa2a65c
197 public static Server server() { 197 public static Server server() {
198 return server; 198 return server;
199 } 199 }
200 200
201 private static final IoLuan.Security ioSecurity(String dir) { 201 private static final IoLuan.Security ioSecurity(String dir) {
202 final String siteDir = dir + "/site/"; 202 final String siteUri = "file:" + dir + "/site";
203 return new IoLuan.Security() { 203 return new IoLuan.Security() {
204 public void check(LuanState luan,String name) throws LuanException { 204 public void check(LuanState luan,String name) throws LuanException {
205 if( name.startsWith("file:") ) { 205 if( name.startsWith("file:") ) {
206 if( name.contains("..") ) 206 if( name.contains("..") )
207 throw new LuanException("Security violation - '"+name+"' contains '..'"); 207 throw new LuanException("Security violation - '"+name+"' contains '..'");
208 if( !name.startsWith("file:"+siteDir) ) 208 if( !(name.equals(siteUri) || name.startsWith(siteUri+"/")) )
209 throw new LuanException("Security violation - '"+name+"' outside of site dir"); 209 throw new LuanException("Security violation - '"+name+"' outside of site dir");
210 } 210 }
211 else if( name.startsWith("classpath:luan/host/") ) { 211 else if( name.startsWith("classpath:luan/host/") ) {
212 throw new LuanException("Security violation"); 212 throw new LuanException("Security violation");
213 } 213 }