1
0
mirror of https://github.com/luanti-org/luanti.git synced 2025-10-21 03:55:21 +02:00
Files
luanti/src
ShadowNinja 0f0502109e Security: Fix resolving of some relative paths
Trying to resolve a path with RemoveRelativePathComponents that can't
be resolved without leaving leading parent components (e.g. "../worlds/foo"
or "bar/../../worlds/foo") will fail.  To work around this, we leave
the relative components and simply remove the trailing components one
at a time, and bail out when we find a parent component.  This will
still fail for paths like "worlds/foo/noexist/../auth.txt" (the path
before the last parent component must not exist), but this is fine
since you won't be able to open a file with a path like that anyways
(the O.S. will determine that the path doesn't exist.
Try `cat /a/../etc/passwd`).
2016-12-20 17:17:38 +10:00
..
2015-05-12 21:07:46 +02:00
2015-03-27 15:00:48 -04:00
2016-12-20 17:17:38 +10:00
2015-02-17 15:07:05 +01:00
2016-03-19 21:27:57 -04:00
2015-08-23 22:04:06 -04:00
2015-12-07 13:51:41 -05:00
2013-02-24 20:15:24 +01:00
2016-02-11 16:55:15 +01:00
2016-02-11 16:55:15 +01:00
2016-09-21 08:04:11 +02:00
2013-02-24 20:15:24 +01:00
2013-02-24 20:15:24 +01:00
2013-02-24 20:15:24 +01:00
2016-07-05 21:40:13 +02:00
2016-07-05 21:40:13 +02:00
2013-02-24 20:15:24 +01:00
2015-11-06 08:51:14 +01:00
2016-02-18 16:43:29 +01:00
2015-08-25 18:33:52 -04:00
2013-02-24 20:15:24 +01:00
2016-12-20 17:17:38 +10:00
2015-12-07 13:51:41 -05:00
2015-08-25 18:33:52 -04:00
2015-07-08 10:12:44 +02:00
2016-06-03 19:42:57 +02:00
2016-02-18 16:43:29 +01:00
2015-10-14 01:03:54 -04:00
2015-10-26 15:14:22 +01:00
2015-03-25 02:30:17 +10:00
2016-07-10 00:00:14 +10:00
2016-07-03 21:49:33 +02:00
2015-07-23 07:38:13 +02:00
2013-02-24 20:15:24 +01:00
2015-08-25 18:33:52 -04:00
2014-01-13 18:11:08 -05:00
2016-11-12 06:41:04 +00:00
2016-11-12 06:41:04 +00:00
2016-03-19 21:27:57 -04:00
2013-02-24 20:15:24 +01:00
2013-02-24 20:15:24 +01:00
2015-11-06 08:51:14 +01:00
2016-12-07 04:06:00 +00:00
2016-10-27 08:04:42 +02:00
2016-06-11 23:35:17 +01:00
2016-12-12 07:19:05 +00:00
2016-10-27 08:04:42 +02:00
2016-10-27 08:04:42 +02:00
2016-11-12 06:41:04 +00:00
2016-11-12 06:41:04 +00:00
2016-02-19 21:31:22 +01:00
2016-02-19 21:31:22 +01:00
2016-03-02 23:23:31 -05:00
2013-02-24 20:15:24 +01:00
2016-03-19 21:27:57 -04:00
2016-06-11 23:35:17 +01:00
2016-06-11 23:35:17 +01:00
2016-06-04 02:16:06 -04:00
2016-06-04 01:51:44 -04:00
2016-05-01 15:32:02 +02:00
2015-12-07 13:51:41 -05:00
2015-12-07 13:51:41 -05:00
2015-08-23 22:04:06 -04:00
2015-08-23 22:04:06 -04:00
2013-02-24 20:15:24 +01:00
2016-11-05 10:25:30 +01:00
2014-11-19 16:21:59 -05:00
2016-05-23 11:48:30 -04:00
2016-10-13 17:33:16 +02:00
2016-02-11 16:55:15 +01:00
2013-02-24 20:15:24 +01:00
2013-02-24 20:15:24 +01:00
2013-02-24 20:15:24 +01:00
2015-03-27 15:00:48 -04:00
2016-02-11 16:55:15 +01:00