Changeset 746

Timestamp:

01/17/08 00:41:06 (2 years ago)

Author:

hachi

Message:

Don't allow upward directory traversal with concat get.

Files:

• trunk/lib/Perlbal/ClientHTTPBase.pm (modified) (1 diff)

trunk/lib/Perlbal/ClientHTTPBase.pm

@@ -540 +540 @@
     return $self->_simple_response(403, "Multiple file serving isn't enabled") unless $svc->{enable_concatenate_get};
     return $self->_simple_response(403, "Too many files requested") if @multiple_files > 100;
+    return $self->_simple_response(403, "Bogus filenames") if grep { m!(?:\A|/)\.\./! } @multiple_files;
 
     my $remain = @multiple_files + 1;  # 1 for the base directory