From 0aa85e71313390dd07e1a6fb8c4d87b62c1f69a6 Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Sat, 13 Nov 2010 13:50:54 +0000 Subject: [PATCH] libs/web: stricter validation in build_url(), prevents some XSS --- libs/web/luasrc/dispatcher.lua | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua index 8d5c02e60..451476202 100644 --- a/libs/web/luasrc/dispatcher.lua +++ b/libs/web/luasrc/dispatcher.lua @@ -52,11 +52,25 @@ local fi -- @return Relative URL function build_url(...) local path = {...} - local sn = http.getenv("SCRIPT_NAME") or "" + local url = { http.getenv("SCRIPT_NAME") or "" } + + local k, v for k, v in pairs(context.urltoken) do - sn = sn .. "/;" .. k .. "=" .. http.urlencode(v) + url[#url+1] = "/;" + url[#url+1] = http.urlencode(k) + url[#url+1] = "=" + url[#url+1] = http.urlencode(v) end - return sn .. ((#path > 0) and "/" .. table.concat(path, "/") or "") + + local p + for _, p in ipairs(path) do + if p:match("^[a-zA-Z0-9_%-%./,;]+$") then + url[#url+1] = "/" + url[#url+1] = p + end + end + + return table.concat(url, "") end --- Send a 404 error code and render the "error404" template if available. @@ -181,7 +195,7 @@ function dispatch(request) for i, s in ipairs(request) do local tkey, tval if t then - tkey, tval = s:match(";(%w+)=(.*)") + tkey, tval = s:match(";(%w+)=([a-fA-F0-9]*)") end if tkey then -- 2.11.0