adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2025-01-18 18:46:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix path traversal check for Windows based systems

Browse source 
On Windows based systems, both, backward as well as forward
slashes are supported as path separators, thus checking for `DS`
only, would allow to slip in `../` fragments.

refs #5905, cad57dcc28
This commit is contained in:
ndm2 2015-08-19 16:47:53 +02:00
parent daa795dfd3
commit 8fe953548c
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/Cake/Network/CakeResponse.php
View file

@ -1337,7 +1337,7 @@ class CakeResponse {
'download' => null
);
if (strpos($path, '..' . DS) !== false) {
if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
throw new NotFoundException(__d(
'cake_dev',
'The requested file contains `..` and will not be read.'

16
lib/Cake/Test/Case/Network/CakeResponseTest.php
View file

@ -1167,17 +1167,29 @@ class CakeResponseTest extends CakeTestCase {
}
/**
* test file with ..
* test file with ../
*
* @expectedException NotFoundException
* @expectedExceptionMessage The requested file contains `..` and will not be read.
* @return void
*/
public function testFileWithPathTraversal() {
public function testFileWithForwardSlashPathTraversal() {
$response = new CakeResponse();
$response->file('my/../cat.gif');
}
/**
* test file with ..\
*
* @expectedException NotFoundException
* @expectedExceptionMessage The requested file contains `..` and will not be read.
* @return void
*/
public function testFileWithBackwardSlashPathTraversal() {
$response = new CakeResponse();
$response->file('my\..\cat.gif');
}
/**
* Although unlikely, a file may contain dots in its filename.
* This should be allowed, as long as the dots doesn't specify a path (../ or ..\)