apr_filepath_merge includes APR_FILEPATH_SECURE_ROOT tests that can

  easily (and cross-platform, safely) assure a path is within a given root.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@90977 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index ace26efe27c279e4d875644c825e5f8b7e436b0f..bbd400ded0ed8f5633103b5843f1a0a46bd27925 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -958,7 +958,7 @@ static void ap_ssi_parse_string(request_rec *r, const char *in, char *out,
 /* ensure that path is relative, and does not contain ".." elements
  * ensentially ensure that it does not match the regex:
  * (^/|(^|/)\.\.(/|$))
- * XXX: Needs to become apr_is_path_relative() test
+ * XXX: Simply replace with apr_filepath_merge                    
  */
 static int is_only_below(const char *path)
 {
@@ -1024,7 +1024,9 @@ static int handle_include(include_ctx_t *ctx, apr_bucket_brigade **bb,
                 ap_ssi_parse_string(r, tag_val, parsed_string, 
                                     sizeof(parsed_string), 0);
                 if (tag[0] == 'f') {
-                    /* be safe; only files in this directory or below allowed */
+                    /* XXX: Port to apr_filepath_merge
+                     * be safe; only files in this directory or below allowed 
+                     */
                     if (!is_only_below(parsed_string)) {
                         error_fmt = "unable to include file \"%s\" "
                                     "in parsed file %s";
@@ -1298,7 +1300,9 @@ static int find_file(request_rec *r, const char *directive, const char *tag,
     apr_status_t rv = APR_SUCCESS;
 
     if (!strcmp(tag, "file")) {
-        /* be safe; only files in this directory or below allowed */
+        /* XXX: Port to apr_filepath_merge
+         * be safe; only files in this directory or below allowed 
+         */
         if (!is_only_below(tag_val)) {
             error_fmt = "unable to access file \"%s\" "
                         "in parsed file %s";