[interchange-cvs] interchange - kwalsh modified
lib/Vend/Interpolate.pm
interchange-cvs at icdevgroup.org
interchange-cvs at icdevgroup.org
Wed Oct 10 21:37:17 EDT 2007
User: kwalsh
Date: 2007-10-11 01:37:16 GMT
Modified: lib/Vend Interpolate.pm
Log:
* Fixed something that looked like a security bug. It seemed to me
that a filename of "tmp/../../../../something" would get past the
checks, so changed the code to make use of Vend::File::allowed_file()
instead.
Revision Changes Path
2.286 +6 -4 interchange/lib/Vend/Interpolate.pm
rev 2.286, prev_rev 2.285
Index: Interpolate.pm
===================================================================
RCS file: /var/cvs/interchange/lib/Vend/Interpolate.pm,v
retrieving revision 2.285
retrieving revision 2.286
diff -u -r2.285 -r2.286
--- Interpolate.pm 17 Sep 2007 05:37:31 -0000 2.285
+++ Interpolate.pm 11 Oct 2007 01:37:16 -0000 2.286
@@ -1,6 +1,6 @@
# Vend::Interpolate - Interpret Interchange tags
#
-# $Id: Interpolate.pm,v 2.285 2007/09/17 05:37:31 kwalsh Exp $
+# $Id: Interpolate.pm,v 2.286 2007/10/11 01:37:16 kwalsh Exp $
#
# Copyright (C) 2002-2007 Interchange Development Group
# Copyright (C) 1996-2002 Red Hat, Inc.
@@ -28,7 +28,7 @@
require Exporter;
@ISA = qw(Exporter);
-$VERSION = substr(q$Revision: 2.285 $, 10);
+$VERSION = substr(q$Revision: 2.286 $, 10);
@EXPORT = qw (
@@ -2279,10 +2279,12 @@
my $file = $opt->{outfile};
$file =~ s/^\s+//;
$file =~ s/\s+$//;
- if($file =~ m{^([A-Za-z]:)?[\\/.]}) {
- logError("attempt to write absolute file $file");
+
+ unless (Vend::File::allowed_file($file)) {
+ Vend::File::log_file_violation($file, 'value-extended');
return '';
}
+
if($opt->{ascii}) {
my $replace = $^O =~ /win32/i ? "\r\n" : "\n";
if($CGI::file{$var} !~ /\n/) {
More information about the interchange-cvs
mailing list