Mercurial Hosting > luan

changeset 1174:bdf27aa2a65c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix luanhost security bug
author Franklin Schmidt <fschmidt@gmail.com>
date Sun, 11 Feb 2018 17:13:40 -0700
parents bdbd1d12c1f2
children d6d0bd05ad8c
files src/luan/host/WebHandler.java
diffstat 1 files changed, 2 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/luan/host/WebHandler.java	Sun Feb 11 16:31:02 2018 -0700
+++ b/src/luan/host/WebHandler.java	Sun Feb 11 17:13:40 2018 -0700
@@ -199,13 +199,13 @@
 	}
 
 	private static final IoLuan.Security ioSecurity(String dir) {
-		final String siteDir = dir + "/site/";
+		final String siteUri = "file:" + dir + "/site";
 		return new IoLuan.Security() {
 			public void check(LuanState luan,String name) throws LuanException {
 				if( name.startsWith("file:") ) {
 					if( name.contains("..") )
 						throw new LuanException("Security violation - '"+name+"' contains '..'");
-					if( !name.startsWith("file:"+siteDir) )
+					if( !(name.equals(siteUri) || name.startsWith(siteUri+"/")) )
 						throw new LuanException("Security violation - '"+name+"' outside of site dir");
 				}
 				else if( name.startsWith("classpath:luan/host/") ) {