vsftpd/0007-Make-filename-filters-smarter.patch

103 lines
3.1 KiB
Diff
Raw Normal View History

2016-11-17 13:35:34 +00:00
From 548375b2122f83771dc0b8571f16e5b5adabba98 Mon Sep 17 00:00:00 2001
2016-03-17 13:10:03 +00:00
From: Martin Sehnoutka <msehnout@redhat.com>
2016-11-17 13:35:34 +00:00
Date: Wed, 7 Sep 2016 10:04:31 +0200
Subject: [PATCH 07/59] Make filename filters smarter.
2016-03-17 13:10:03 +00:00
2016-11-17 13:35:34 +00:00
In the original version vsftpd was not able to prevent
users from downloading for instance /etc/passwd by
defining filters such as deny_file=/etc/passwd or /etc*
or passwd. Example of erroneous behavior:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd /
250 Directory successfully changed.
ftp> cd /etc
550 Permission denied.
ftp> cd etc
250 Directory successfully changed.
ftp> get passwd
local: passwd remote: passwd
227 Entering Passive Mode (127,0,0,1,99,251)
150 Opening BINARY mode data connection for passwd (2813 bytes).
226 File send OK.
2813 bytes received in 0.00016 seconds (1.7e+04 Kbytes/s)
ftp> quit
221 Goodbye.
2016-03-17 13:10:03 +00:00
---
2016-11-17 13:35:34 +00:00
ls.c | 24 +++++++++++++++++++++++-
2016-03-17 13:10:03 +00:00
str.c | 11 +++++++++++
str.h | 1 +
2016-11-17 13:35:34 +00:00
3 files changed, 35 insertions(+), 1 deletion(-)
2016-03-17 13:10:03 +00:00
diff --git a/ls.c b/ls.c
2016-11-17 13:35:34 +00:00
index 7e1376d..f489478 100644
2016-03-17 13:10:03 +00:00
--- a/ls.c
+++ b/ls.c
2016-11-17 13:35:34 +00:00
@@ -246,8 +246,30 @@ vsf_filename_passes_filter(const struct mystr* p_filename_str,
int ret = 0;
char last_token = 0;
int must_match_at_current_pos = 1;
2016-11-17 13:35:34 +00:00
+
+
str_copy(&filter_remain_str, p_filter_str);
- str_copy(&name_remain_str, p_filename_str);
2016-11-17 13:35:34 +00:00
+
+ if (!str_isempty (&filter_remain_str) && !str_isempty(p_filename_str)) {
+ if (str_get_char_at(p_filter_str, 0) == '/') {
+ if (str_get_char_at(p_filename_str, 0) != '/') {
+ str_getcwd (&name_remain_str);
2016-11-17 13:35:34 +00:00
+
+ if (str_getlen(&name_remain_str) > 1) /* cwd != root dir */
+ str_append_char (&name_remain_str, '/');
2016-11-17 13:35:34 +00:00
+
+ str_append_str (&name_remain_str, p_filename_str);
+ }
+ else
+ str_copy (&name_remain_str, p_filename_str);
+ } else {
+ if (str_get_char_at(p_filter_str, 0) != '{')
+ str_basename (&name_remain_str, p_filename_str);
+ else
+ str_copy (&name_remain_str, p_filename_str);
+ }
+ } else
+ str_copy(&name_remain_str, p_filename_str);
2016-11-17 13:35:34 +00:00
2011-02-16 10:05:47 +00:00
while (!str_isempty(&filter_remain_str) && *iters < VSFTP_MATCHITERS_MAX)
{
2016-03-17 13:10:03 +00:00
diff --git a/str.c b/str.c
index 6596204..ba4b92a 100644
--- a/str.c
+++ b/str.c
@@ -711,3 +711,14 @@ str_replace_unprintable(struct mystr* p_str, char new_char)
}
}
+void
+str_basename (struct mystr* d_str, const struct mystr* path)
+{
2008-05-21 13:51:06 +00:00
+ static struct mystr tmp;
+
+ str_copy (&tmp, path);
+ str_split_char_reverse(&tmp, d_str, '/');
+
+ if (str_isempty(d_str))
+ str_copy (d_str, path);
+}
2016-03-17 13:10:03 +00:00
diff --git a/str.h b/str.h
index ab0a9a4..3a21b50 100644
--- a/str.h
+++ b/str.h
@@ -100,6 +100,7 @@ void str_replace_unprintable(struct mystr* p_str, char new_char);
int str_atoi(const struct mystr* p_str);
filesize_t str_a_to_filesize_t(const struct mystr* p_str);
unsigned int str_octal_to_uint(const struct mystr* p_str);
+void str_basename (struct mystr* d_str, const struct mystr* path);
/* PURPOSE: Extract a line of text (delimited by \n or EOF) from a string
* buffer, starting at character position 'p_pos'. The extracted line will
2016-03-17 13:10:03 +00:00
--
2.14.4
2016-03-17 13:10:03 +00:00