adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2025-01-19 02:56:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #7260 from ndm2/2.7-fix-path-traversal-protection-for-win-os

Browse source 
Fix path traversal check for Windows based systems
This commit is contained in:
Mark Story 2015-08-19 14:50:52 -04:00
commit 3532619515
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/Cake/Network/CakeResponse.php
View file

@ -1337,7 +1337,7 @@ class CakeResponse {
'download' => null
);
if (strpos($path, '..' . DS) !== false) {
if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
throw new NotFoundException(__d(
'cake_dev',
'The requested file contains `..` and will not be read.'

16
lib/Cake/Test/Case/Network/CakeResponseTest.php
View file

@ -1167,17 +1167,29 @@ class CakeResponseTest extends CakeTestCase {
}
/**
* test file with ..
* test file with ../
*
* @expectedException NotFoundException
* @expectedExceptionMessage The requested file contains `..` and will not be read.
* @return void
*/
public function testFileWithPathTraversal() {
public function testFileWithForwardSlashPathTraversal() {
$response = new CakeResponse();
$response->file('my/../cat.gif');
}
/**
* test file with ..\
*
* @expectedException NotFoundException
* @expectedExceptionMessage The requested file contains `..` and will not be read.
* @return void
*/
public function testFileWithBackwardSlashPathTraversal() {
$response = new CakeResponse();
$response->file('my\..\cat.gif');
}
/**
* Although unlikely, a file may contain dots in its filename.
* This should be allowed, as long as the dots doesn't specify a path (../ or ..\)