From 3e7f149be64e64e93afe01696d2cbb48770ba70c Mon Sep 17 00:00:00 2001 From: Stefan Esser Date: Sun, 12 Sep 2004 10:46:49 +0000 Subject: [PATCH] MFH --- main/rfc1867.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/main/rfc1867.c b/main/rfc1867.c index 1c2adef9a6..b6604d04d7 100644 --- a/main/rfc1867.c +++ b/main/rfc1867.c @@ -932,6 +932,25 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) } SAFE_RETURN; } + + /* New Rule: never repair potential malicious user input */ + if (!skip_upload) { + char *tmp = param; + long c = 0; + + while (*tmp) { + if (*tmp == '[') { + c++; + } else if (*tmp == ']') { + c--; + } + if (c < 0) { + skip_upload = 1; + break; + } + tmp++; + } + } if (!skip_upload) { /* Handle file */ @@ -1000,10 +1019,6 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) * start_arr is set to point to 1st [ */ is_arr_upload = (start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']'); - /* handle unterminated [ */ - if (!is_arr_upload && start_arr) { - *start_arr = '_'; - } if (is_arr_upload) { array_len = strlen(start_arr); -- 2.40.0