From 40387c8987ef9f01ca97bc5e89db2a35c328f9a3 Mon Sep 17 00:00:00 2001 From: Adam Dickmeiss Date: Fri, 16 Dec 2011 12:45:37 +0100 Subject: [PATCH] http_file: URI decode paths; strip #, ?. --- src/filter_http_file.cpp | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/filter_http_file.cpp b/src/filter_http_file.cpp index 863fe66..5e0d6c0 100644 --- a/src/filter_http_file.cpp +++ b/src/filter_http_file.cpp @@ -23,6 +23,7 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA #include "filter_http_file.hpp" #include +#include #include @@ -179,12 +180,21 @@ void yf::HttpFile::Rep::fetch_uri(mp::Session &session, Z_HTTP_Request *req, mp::Package &package) { bool sane = true; + std::string::size_type p; std::string path = req->path; + + p = path.find("#"); + if (p != std::string::npos) + path = path.erase(p); + + p = path.find("?"); + if (p != std::string::npos) + path = path.erase(p); - // we don't consider ?, # yet.. + path = mp::util::uri_decode(path); // we don't allow .. - std::string::size_type p = path.find(".."); + p = path.find(".."); if (p != std::string::npos) sane = false; @@ -198,7 +208,7 @@ void yf::HttpFile::Rep::fetch_uri(mp::Session &session, if (path.compare(0, l, it->m_url_path_prefix) == 0) { std::string fname = it->m_file_root + path.substr(l); - std::cout << "fname = " << fname << "\n"; + package.log("http_file", YLOG_LOG, "%s", fname.c_str()); fetch_file(session, req, fname, package); return; } -- 1.7.10.4