facebook/zstd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2512 from felixhandte/fix-2509

Browse Source 
Detect `..` in Paths Correctly
This commit is contained in:
Felix Handte 2021-02-26 18:02:18 -05:00 committed by GitHub
commit 45ee23f6a1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 33 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
programs/util.c
View File

@ -679,7 +679,27 @@ const char* UTIL_getFileExtension(const char* infilename)
static int pathnameHas2Dots(const char *pathname)
{
return NULL != strstr(pathname, "..");
/* We need to figure out whether any ".." present in the path is a whole
* path token, which is the case if it is bordered on both sides by either
* the beginning/end of the path or by a directory separator.
*/
const char *needle = pathname;
while (1) {
needle = strstr(needle, "..");
if (needle == NULL) {
return 0;
}
if ((needle == pathname || needle[-1] == PATH_SEP)
&& (needle[2] == '\0' || needle[2] == PATH_SEP)) {
return 1;
}
/* increment so we search for the next match */
needle++;
};
return 0;
}
static int isFileNameValidForMirroredOutput(const char *filename)

18
tests/playTests.sh
View File

@ -486,23 +486,29 @@ rm -rf tmp*
if [ "$isWindows" = false ] ; then
println "\n===> compress multiple files into an output directory and mirror input folder, --output-dir-mirror"
println "test --output-dir-mirror" > tmp1
mkdir -p tmpInputTestDir/we/must/go/deeper
println cool > tmpInputTestDir/we/must/go/deeper/tmp2
mkdir -p tmpInputTestDir/we/.../..must/go/deeper..
println cool > tmpInputTestDir/we/.../..must/go/deeper../tmp2
zstd tmp1 -r tmpInputTestDir --output-dir-mirror tmpOutDir
test -f tmpOutDir/tmp1.zst
test -f tmpOutDir/tmpInputTestDir/we/must/go/deeper/tmp2.zst
test -f tmpOutDir/tmpInputTestDir/we/.../..must/go/deeper../tmp2.zst
println "test: compress input dir will be ignored if it has '..'"
zstd -r tmpInputTestDir/we/must/../must --output-dir-mirror non-exist && die "input cannot contain '..'"
zstd -r tmpInputTestDir/we/.../..must/../..mustgo/deeper.. --output-dir-mirror non-exist && die "input cannot contain '..'"
zstd -r tmpInputTestDir/we/.../..must/deeper../.. --output-dir-mirror non-exist && die "input cannot contain '..'"
zstd -r ../tests/tmpInputTestDir/we/.../..must/deeper.. --output-dir-mirror non-exist && die "input cannot contain '..'"
test ! -d non-exist
println "test: compress input dir should succeed with benign uses of '..'"
zstd -r tmpInputTestDir/we/.../..must/go/deeper.. --output-dir-mirror tmpout
test -d tmpout
println "test : decompress multiple files into an output directory, --output-dir-mirror"
zstd tmpOutDir -r -d --output-dir-mirror tmpOutDirDecomp
test -f tmpOutDirDecomp/tmpOutDir/tmp1
test -f tmpOutDirDecomp/tmpOutDir/tmpInputTestDir/we/must/go/deeper/tmp2
test -f tmpOutDirDecomp/tmpOutDir/tmpInputTestDir/we/.../..must/go/deeper../tmp2
println "test: decompress input dir will be ignored if it has '..'"
zstd -r tmpOutDir/tmpInputTestDir/we/must/../must --output-dir-mirror non-exist && die "input cannot contain '..'"
zstd -r tmpOutDir/tmpInputTestDir/we/.../..must/../..must --output-dir-mirror non-exist && die "input cannot contain '..'"
test ! -d non-exist
rm -rf tmp*