mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-09-30 19:47:47 +03:00
Adds support to the transformation normalisePathWin
This commit is contained in:
167
src/utils.cc
167
src/utils.cc
@@ -619,6 +619,173 @@ HTML_ENT_OUT:
|
||||
return count;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
* IMP1 Assumes NUL-terminated
|
||||
*/
|
||||
int normalize_path_inplace(unsigned char *input, int input_len,
|
||||
int win, int *changed) {
|
||||
unsigned char *src;
|
||||
unsigned char *dst;
|
||||
unsigned char *end;
|
||||
int ldst = 0;
|
||||
int hitroot = 0;
|
||||
int done = 0;
|
||||
int relative;
|
||||
int trailing;
|
||||
|
||||
*changed = 0;
|
||||
|
||||
/* Need at least one byte to normalize */
|
||||
if (input_len <= 0) return 0;
|
||||
|
||||
/*
|
||||
* ENH: Deal with UNC and drive letters?
|
||||
*/
|
||||
|
||||
src = dst = input;
|
||||
end = input + (input_len - 1);
|
||||
ldst = 1;
|
||||
|
||||
relative = ((*input == '/') || (win && (*input == '\\'))) ? 0 : 1;
|
||||
trailing = ((*end == '/') || (win && (*end == '\\'))) ? 1 : 0;
|
||||
|
||||
|
||||
while (!done && (src <= end) && (dst <= end)) {
|
||||
/* Convert backslash to forward slash on Windows only. */
|
||||
if (win) {
|
||||
if (*src == '\\') {
|
||||
*src = '/';
|
||||
*changed = 1;
|
||||
}
|
||||
if ((src < end) && (*(src + 1) == '\\')) {
|
||||
*(src + 1) = '/';
|
||||
*changed = 1;
|
||||
}
|
||||
}
|
||||
|
||||
/* Always normalize at the end of the input. */
|
||||
if (src == end) {
|
||||
done = 1;
|
||||
} else if (*(src + 1) != '/') {
|
||||
/* Skip normalization if this is NOT the
|
||||
*end of the path segment. */
|
||||
goto copy; /* Skip normalization. */
|
||||
}
|
||||
|
||||
/*** Normalize the path segment. ***/
|
||||
|
||||
/* Could it be an empty path segment? */
|
||||
if ((src != end) && *src == '/') {
|
||||
/* Ignore */
|
||||
*changed = 1;
|
||||
goto copy; /* Copy will take care of this. */
|
||||
} else if (*src == '.') {
|
||||
/* Could it be a back or self reference? */
|
||||
/* Back-reference? */
|
||||
if ((dst > input) && (*(dst - 1) == '.')) {
|
||||
/* If a relative path and either our normalization has
|
||||
* already hit the rootdir, or this is a backref with no
|
||||
* previous path segment, then mark that the rootdir was hit
|
||||
* and just copy the backref as no normilization is possible.
|
||||
*/
|
||||
if (relative && (hitroot || ((dst - 2) <= input))) {
|
||||
hitroot = 1;
|
||||
|
||||
goto copy; /* Skip normalization. */
|
||||
}
|
||||
|
||||
/* Remove backreference and the previous path segment. */
|
||||
dst -= 3;
|
||||
while ((dst > input) && (*dst != '/')) {
|
||||
dst--;
|
||||
}
|
||||
|
||||
/* But do not allow going above rootdir. */
|
||||
if (dst <= input) {
|
||||
hitroot = 1;
|
||||
dst = input;
|
||||
|
||||
/* Need to leave the root slash if this
|
||||
* is not a relative path and the end was reached
|
||||
* on a backreference.
|
||||
*/
|
||||
if (!relative && (src == end)) {
|
||||
dst++;
|
||||
}
|
||||
}
|
||||
|
||||
if (done) goto length; /* Skip the copy. */
|
||||
src++;
|
||||
|
||||
*changed = 1;
|
||||
} else if (dst == input) {
|
||||
/* Relative Self-reference? */
|
||||
*changed = 1;
|
||||
|
||||
/* Ignore. */
|
||||
|
||||
if (done) goto length; /* Skip the copy. */
|
||||
src++;
|
||||
} else if (*(dst - 1) == '/') {
|
||||
/* Self-reference? */
|
||||
*changed = 1;
|
||||
|
||||
/* Ignore. */
|
||||
|
||||
if (done) goto length; /* Skip the copy. */
|
||||
dst--;
|
||||
src++;
|
||||
}
|
||||
} else if (dst > input) {
|
||||
/* Found a regular path segment. */
|
||||
hitroot = 0;
|
||||
}
|
||||
|
||||
copy:
|
||||
/*** Copy the byte if required. ***/
|
||||
|
||||
/* Skip to the last forward slash when multiple are used. */
|
||||
if (*src == '/') {
|
||||
unsigned char *oldsrc = src;
|
||||
|
||||
while ((src < end)
|
||||
&& ((*(src + 1) == '/') || (win && (*(src + 1) == '\\'))) ) {
|
||||
src++;
|
||||
}
|
||||
if (oldsrc != src) *changed = 1;
|
||||
|
||||
/* Do not copy the forward slash to the root
|
||||
* if it is not a relative path. Instead
|
||||
* move over the slash to the next segment.
|
||||
*/
|
||||
if (relative && (dst == input)) {
|
||||
src++;
|
||||
goto length; /* Skip the copy */
|
||||
}
|
||||
}
|
||||
|
||||
*(dst++) = *(src++);
|
||||
|
||||
length:
|
||||
ldst = (dst - input);
|
||||
}
|
||||
/* Make sure that there is not a trailing slash in the
|
||||
* normalized form if there was not one in the original form.
|
||||
*/
|
||||
if (!trailing && (dst > input) && *(dst - 1) == '/') {
|
||||
ldst--;
|
||||
dst--;
|
||||
}
|
||||
|
||||
/* Always NUL terminate */
|
||||
*dst = '\0';
|
||||
|
||||
return ldst;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Converts a single hexadecimal digit into a decimal value.
|
||||
*/
|
||||
|
Reference in New Issue
Block a user