/* * Copyright 2023, Vincent Douillet * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * * 1. Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * 3. Neither the name of the copyright holder nor the names of its contributors * may be used to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #include #include #include #include #include #include "config.h" #include "url.h" bool check_request_path(const char *path, const char *suffix) { char p [PATH_MAX], resolved[PATH_MAX]; char *rp, *data_dir; data_dir = config_data_dir(); if (data_dir == NULL) return false; /* build absolute path from DATA_DIR */ if (strlcpy(p, data_dir, sizeof(p)) >= sizeof(p)) return false; if (strlcat(p, "/", sizeof(p)) >= sizeof(p)) return false; if (strlcat(p, path, sizeof(p)) >= sizeof(p)) return false; if (strlen(suffix) > 0) { /* add suffix */ if (strlcat(p, ".", sizeof(p)) >= sizeof(p)) return false; if (strlcat(p, suffix, sizeof(p)) >= sizeof(p)) return false; } /* canonicalize the path */ rp = realpath(p, resolved); if (rp == NULL) return false; /* path must start with DATA_DIR */ rp[PATH_MAX - 1] = '\0'; if (strstr(rp, data_dir) != rp) return false; return true; } size_t url_build(char *dst, size_t dst_size,...) { va_list path_list; const char *path; size_t w_size; dst[0] = '\0'; w_size = 0; va_start(path_list, dst_size); while ((path = va_arg(path_list, char *)) != NULL) { /* no more space in dst buffer */ if (w_size >= dst_size) break; if (path[0] == '\0') continue; if (path[0] == '.' && path[1] == '\0') continue; if (path[0] != '/' && w_size > 0 && dst[w_size - 1] != '/') strlcat(dst, "/", dst_size); w_size = strlcat(dst, path, dst_size); } va_end(path_list); return w_size; }