util.prosodyctl: Handle os.execute in Lua 5.2 returning true when command terminates...

[prosody.git] / plugins / mod_http_files.lua

diff --git a/plugins/mod_http_files.lua b/plugins/mod_http_files.lua
index 3a9368b9a65160a5b44c98c9be4fd25f77040905..3b60249559c6e7e42bee94699d0f14ba122f7c4b 100644 (file)
--- a/plugins/mod_http_files.lua
+++ b/plugins/mod_http_files.lua
@@ -1,7 +1,7 @@
 -- Prosody IM
 -- Copyright (C) 2008-2010 Matthew Wild
 -- Copyright (C) 2008-2010 Waqas Hussain
--- 
+--
 -- This project is MIT/X11 licensed. Please see the
 -- COPYING file in the source package for more information.
 --
@@ -49,6 +49,38 @@ if not mime_map then
        end
 end
 
+local forbidden_chars_pattern = "[/%z]";
+if prosody.platform == "windows" then
+       forbidden_chars_pattern = "[/%z\001-\031\127\"*:<>?|]"
+end
+
+local urldecode = require "util.http".urldecode;
+function sanitize_path(path)
+       if not path then return end
+       local out = {};
+
+       local c = 0;
+       for component in path:gmatch("([^/]+)") do
+               component = urldecode(component);
+               if component:find(forbidden_chars_pattern) then
+                       return nil;
+               elseif component == ".." then
+                       if c <= 0 then
+                               return nil;
+                       end
+                       out[c] = nil;
+                       c = c - 1;
+               elseif component ~= "." then
+                       c = c + 1;
+                       out[c] = component;
+               end
+       end
+       if path:sub(-1,-1) == "/" then
+               out[c+1] = "";
+       end
+       return "/"..table.concat(out, "/");
+end
+
 local cache = setmetatable({}, { __mode = "kv" }); -- Let the garbage collector have it if it wants to.
 
 function serve(opts)
@@ -60,9 +92,14 @@ function serve(opts)
        local directory_index = opts.directory_index;
        local function serve_file(event, path)
                local request, response = event.request, event.response;
-               local orig_path = request.path;
-               local full_path = base_path .. (path and "/"..path or "");
-               local attr = stat((full_path:gsub('%'..path_sep..'+$','')));
+               local sanitized_path = sanitize_path(path);
+               if path and not sanitized_path then
+                       return 400;
+               end
+               path = sanitized_path;
+               local orig_path = sanitize_path(request.path);
+               local full_path = base_path .. (path or ""):gsub("/", path_sep);
+               local attr = stat(full_path:match("^.*[^\\/]")); -- Strip trailing path separator because Windows
                if not attr then
                        return 404;
                end