github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 05:45:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

Less strict multipart parsing

Browse Source
This commit is contained in:
Allan Boll 2017-06-16 17:42:24 -07:00 committed by Victor Hora
parent b600669d02
commit 7af8363fd4
1 changed files with 20 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
apache2/msc_multipart.c
View File

@ -695,42 +695,29 @@ static int multipart_boundary_characters_valid(char *boundary) {
if (p == NULL) return -1;
while((c = *p) != '\0') {
/* Control characters and space not allowed. */
if (c < 32) {
while ((c = *p) != '\0') {
// Check against allowed list defined in RFC2046 page 21
if (!(
('0' <= c && c <= '9')
|| ('A' <= c && c <= 'Z')
|| ('a' <= c && c <= 'z')
|| (c == ' ' && *(p + 1) != '\0') // space allowed, but not as last character
|| c == '\''
|| c == '('
|| c == ')'
|| c == '+'
|| c == '_'
|| c == ','
|| c == '-'
|| c == '.'
|| c == '/'
|| c == ':'
|| c == '='
|| c == '?'
)) {
return 0;
}
/* Non-ASCII characters not allowed. */
if (c > 126) {
return 0;
}
switch(c) {
/* Special characters not allowed. */
case '(' :
case ')' :
case '<' :
case '>' :
case '@' :
case ',' :
case ';' :
case ':' :
case '\\' :
case '"' :
case '/' :
case '[' :
case ']' :
case '?' :
case '=' :
return 0;
break;
default :
/* Do nothing. */
break;
}
p++;
}