Thu, 03 Aug 2017 11:38:41 +0200
adds resource name validation
crypto-name could contain path separators
libidav/resource.c | file | annotate | diff | comparison | revisions |
--- a/libidav/resource.c Thu Aug 03 10:37:52 2017 +0200 +++ b/libidav/resource.c Thu Aug 03 11:38:41 2017 +0200 @@ -79,15 +79,25 @@ } DavResource* dav_resource_new_full(DavSession *sn, char *parent_path, char *name, char *href) { + sstr_t n = sstr(name); + // the name must not contain path separators + for(int i=0;i<n.length-1;i++) { + char c = n.ptr[i]; + if(c == '/' || c == '\\') { + n = sstr(util_resource_name(href)); + break; + } + } + // remove trailing '/' + if(n.length > 0 && n.ptr[n.length-1] == '/') { + n.length--; + } + DavResource *res = ucx_mempool_calloc(sn->mp, 1, sizeof(DavResource)); res->session = sn; // set name, path and href - sstr_t n = sstr(name); res->name = sstrdup_a(sn->mp->allocator, n).ptr; - if(n.length > 0 && n.ptr[n.length-1] == '/') { - res->name[n.length-1] = '\0'; - } char *path = util_concat_path(parent_path, name); res->path = dav_session_strdup(sn, path);