diff options
| author | Koop Mast <kwm@FreeBSD.org> | 2011-07-28 19:20:07 +0000 |
|---|---|---|
| committer | Koop Mast <kwm@FreeBSD.org> | 2011-07-28 19:20:07 +0000 |
| commit | ddf70a3e70da9a133e3126d889bbb9bbe5496bda (patch) | |
| tree | 88db1b4d99e817da4ece0c6915625c60e732e89a /devel/libsoup | |
| parent | 53ec1b85283379e9b67107a22b984c63b0de37f7 (diff) | |
| download | ports-ddf70a3e70da9a133e3126d889bbb9bbe5496bda.tar.gz ports-ddf70a3e70da9a133e3126d889bbb9bbe5496bda.zip | |
Notes
Diffstat (limited to 'devel/libsoup')
| -rw-r--r-- | devel/libsoup/Makefile | 2 | ||||
| -rw-r--r-- | devel/libsoup/files/patch-libsoup_soup-server.c | 34 |
2 files changed, 35 insertions, 1 deletions
diff --git a/devel/libsoup/Makefile b/devel/libsoup/Makefile index 7053e556545b..4e47a12161c8 100644 --- a/devel/libsoup/Makefile +++ b/devel/libsoup/Makefile @@ -8,7 +8,7 @@ PORTNAME= libsoup PORTVERSION= 2.32.2 -PORTREVISION?= 2 +PORTREVISION?= 3 CATEGORIES= devel gnome MASTER_SITES= GNOME DIST_SUBDIR= gnome2 diff --git a/devel/libsoup/files/patch-libsoup_soup-server.c b/devel/libsoup/files/patch-libsoup_soup-server.c new file mode 100644 index 000000000000..93116ad065a3 --- /dev/null +++ b/devel/libsoup/files/patch-libsoup_soup-server.c @@ -0,0 +1,34 @@ +From 51eb8798c3965b49f3010db82009d36429f28514 Mon Sep 17 00:00:00 2001 +From: Dan Winship <danw@gnome.org> +Date: Wed, 29 Jun 2011 14:04:06 +0000 +Subject: SoupServer: fix to not allow smuggling ".." into path + +When SoupServer:raw-paths was set (the default), it was possible to +sneak ".." segments into the path passed to the SoupServerHandler, +which could then end up tricking some handlers into retrieving +arbitrary files from the filesystem. Fix that. + +https://bugzilla.gnome.org/show_bug.cgi?id=653258 +--- +diff --git a/libsoup/soup-server.c b/libsoup/soup-server.c +index d56efd1..7225337 100644 +--- libsoup/soup-server.c ++++ libsoup/soup-server.c +@@ -779,6 +779,15 @@ got_headers (SoupMessage *req, SoupClientContext *client) + + uri = soup_message_get_uri (req); + decoded_path = soup_uri_decode (uri->path); ++ ++ if (strstr (decoded_path, "/../") || ++ g_str_has_suffix (decoded_path, "/..")) { ++ /* Introducing new ".." segments is not allowed */ ++ g_free (decoded_path); ++ soup_message_set_status (req, SOUP_STATUS_BAD_REQUEST); ++ return; ++ } ++ + soup_uri_set_path (uri, decoded_path); + g_free (decoded_path); + } +-- +cgit v0.9 |