aniani/elinks
1
0
Fork 0
mirror of https://github.com/rkd77/elinks.git synced 2024-09-27 02:56:18 -04:00
Code

1008: assert there's no FILE_CHAR in file names

Browse Source
This commit is contained in:
Kalle Olavi Niemitalo 2008-06-04 01:15:07 +03:00 committed by Kalle Olavi Niemitalo
parent 8e33098306
commit 3e370677c4
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/viewer/text/form.c
View File

@ -941,6 +941,32 @@ encode_multipart(struct session *ses, LIST_OF(struct submitted_value) *l,
filename = expand_tilde(sv->value);
if (!filename) goto encode_error;
/* Do not allow FILE_CHAR in file
* names. It would make the resulting
* *data string ambiguous.
*
* Because FILE_CHAR is a control
* character, the user cannot directly
* type it in a file upload field.
* ELinks also does not let scripts
* modify such fields, for security
* reasons. It seems impossible to
* get FILE_CHAR here, so use assert.
*
* In uri.post, the first '\n' also
* has special meaning. However, '\n'
* in a file name does not cause any
* ambiguity, because get_form_uri()
* always adds a content-type and '\n'
* to the beginning of the encoded
* POST data. */
assert(strchr(filename, FILE_CHAR) == NULL);
if_assert_failed {
mem_free(filename);
errno = EINVAL;
goto encode_error;
}
if (access(filename, R_OK)) {
mem_free(filename);
goto encode_error;