handle invalid paths passed to us from iis

diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index 5d99c2244f35b2bfdd6553c1be11d3cd72e31f91..2295d94e2a055875a0935deb4d16edf282cfb972 100644 (file)
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -827,7 +827,9 @@ static void init_request_info(TSRMLS_D)
 #endif
                SG(request_info).request_method = sapi_cgibin_getenv("REQUEST_METHOD",0 TSRMLS_CC);
                SG(request_info).query_string = sapi_cgibin_getenv("QUERY_STRING",0 TSRMLS_CC);
-               if (script_path_translated)
+               /* some server configurations allow '..' to slip through in the
+                  translated path.   We'll just refuse to handle such a path. */
+               if (script_path_translated && !strstr(script_path_translated,".."))
                        SG(request_info).path_translated = estrdup(script_path_translated);
                SG(request_info).content_type = (content_type ? content_type : "" );
                SG(request_info).content_length = (content_length?atoi(content_length):0);

diff --git a/sapi/isapi/php4isapi.c b/sapi/isapi/php4isapi.c
index 4851a8165ba35986f11a95683c1384ebfc3f4381..0a254d4b5e927d369235301c35648347e1f037d2 100644 (file)
--- a/sapi/isapi/php4isapi.c
+++ b/sapi/isapi/php4isapi.c
@@ -818,13 +818,21 @@ DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB)
 #endif
                        file_handle.type = ZEND_HANDLE_FILENAME;
                        file_handle.opened_path = NULL;
+                       /* some server configurations allow '..' to slip through in the
+                          translated path.   We'll just refuse to handle such a path. */
+                       if (strstr(SG(request_info).path_translated,"..")) {
+                               SG(sapi_headers).http_response_code = 404;
+                               efree(SG(request_info).path_translated);
+                               SG(request_info).path_translated = NULL;
+                       }
 
 
                        php_execute_script(&file_handle TSRMLS_CC);
                        if (SG(request_info).cookie_data) {
                                efree(SG(request_info).cookie_data);
                        }
-                       efree(SG(request_info).path_translated);
+                       if (SG(request_info).path_translated)
+                               efree(SG(request_info).path_translated);
 #ifdef PHP_ENABLE_SEH
                } __except(exceptionhandler(&e, GetExceptionInformation())) {
                        char buf[1024];