do not allow any .. in requested file name

2018-03-14 10:08:37 +01:00 · 2018-03-14 10:08:37 +01:00 · e85ca1478b
parent 7b9c4f9ee8
commit e85ca1478b
1 changed files with 3 additions and 2 deletions
--- a/octoserve/http.c
+++ b/octoserve/http.c
@ -561,7 +561,8 @@ void handle_http(struct os_ssdp *ss)
 					while (buf[j] && buf[j] != '\r' && buf[j] != ' ')
 						j++;
 					buf[j] = 0;
-					if (i == j) {
+					if (i == j ||
+					    (NULL !=strstr(buf + i, ".."))) {
 						send_http_error(ss->csock, 404);
 						break;
 					}