Thread: [Cppcms-users] Problem with http::file and the returned file name
Brought to you by:
artyom-beilis
Menu
▾
▴
cppcms-users
|
From: Christian G. <chr...@gm...> - 2013-07-05 08:42:00
|
Hi all.
In my web application I make use of a file uploader, which works like
a charm. But
I run into this problem:
Some older IE versions (6,7,8) are sending the full path of the uploaded file
in the multipart data - verified via wireshark.
All other browsers (chrome, ff, safari) are sending only the filename.
This looks like:
Jul 5 10:24:51 chgm-pc tssw: Upload: request POST: id 'upload' (upload.cpp:21)
Jul 5 10:24:51 chgm-pc tssw: upload: storing file C:Dokumente und
EinstellungengmeinerEigene DateienDownloads01_257782.pdf - size:
2947635 (upload.cpp:41)
Jul 5 10:24:51 chgm-pc tssw: upload:
/tmp/If37354f45a5f672658789c3a33e95e68/C:Dokumente und
EinstellungengmeinerEigene DateienDownloads01_257782.pdf
(upload.cpp:48)
I thought that I could filter out the substring starting from the last
\ in the filename, but cppcms filters away all \.
Is there a way to configure it or did I found a bug?
The file looks in wireshark like:
C:\Dokumente und Einstellungen\gmeiner\Eigene Dateien\Download\s01_257782.pdf
Here is my currently used uploader
if (id == "upload")
{
upload.form.load(context());
if (upload.form.validate())
{
std::string filename = upload.form.file.value()->filename();
// some versions of the Internet Explorer send the
full path as filename
// and so we need to do some post processing in oder
to only get the filename.
unsigned int found = filename.rfind("\\");
if (found != std::string::npos)
{
BOOSTER_DEBUG("Upload") << "found @ " << found;
filename = filename.substr(found);
}
BOOSTER_DEBUG("upload") << "storing file "
<< filename
<< " - size: " << upload.form.file.value()->size();
// store file in users tmp folder
std::string root = session().get("tmp");
upload.form.file.value()->save_to(root + filename);
BOOSTER_DEBUG("upload") << root + filename;
// TODO: return information's about uploaded file
this->empty_json_response();
}
else
{
BOOSTER_ERROR("upload") << "data not valid";
response().make_error_response(cppcms::http::response::not_acceptable);
}
}
thanks
--
Christian Gmeiner, MSc
|
|
From: Christian G. <chr...@gm...> - 2013-07-05 09:53:25
|
Hi all.
> In my web application I make use of a file uploader, which works like
> a charm. But
> I run into this problem:
>
> Some older IE versions (6,7,8) are sending the full path of the uploaded file
> in the multipart data - verified via wireshark.
> All other browsers (chrome, ff, safari) are sending only the filename.
>
> This looks like:
>
> Jul 5 10:24:51 chgm-pc tssw: Upload: request POST: id 'upload' (upload.cpp:21)
> Jul 5 10:24:51 chgm-pc tssw: upload: storing file C:Dokumente und
> EinstellungengmeinerEigene DateienDownloads01_257782.pdf - size:
> 2947635 (upload.cpp:41)
> Jul 5 10:24:51 chgm-pc tssw: upload:
> /tmp/If37354f45a5f672658789c3a33e95e68/C:Dokumente und
> EinstellungengmeinerEigene DateienDownloads01_257782.pdf
> (upload.cpp:48)
>
> I thought that I could filter out the substring starting from the last
> \ in the filename, but cppcms filters away all \.
> Is there a way to configure it or did I found a bug?
>
> The file looks in wireshark like:
> C:\Dokumente und Einstellungen\gmeiner\Eigene Dateien\Download\s01_257782.pdf
>
Sooo I found the problem in cppcms-1.0.4/private/http_protocol.h:
template<typename It>
std::string unquote(It &begin,It end)
{
It p=begin;
std::string result;
if(p>=end || *p!='\"')
return result;
result.reserve(end-p);
p++;
while(p < end) {
char c=*p++;
if(c=='\"') {
begin=p;
return result;
}
else if(c=='\\' && p<end) <--
result+= *p++; <--
else
result+=c;
}
result.clear();
return result;
}
If I comment out the else if everything works.
How shall I proceed? Send a patch?
--
Christian Gmeiner, MSc
|
|
From: Christian G. <chr...@gm...> - 2013-07-11 11:21:48
|
ping
--
Christian Gmeiner, MSc
2013/7/5 Christian Gmeiner <chr...@gm...>:
> Hi all.
>
>> In my web application I make use of a file uploader, which works like
>> a charm. But
>> I run into this problem:
>>
>> Some older IE versions (6,7,8) are sending the full path of the uploaded file
>> in the multipart data - verified via wireshark.
>> All other browsers (chrome, ff, safari) are sending only the filename.
>>
>> This looks like:
>>
>> Jul 5 10:24:51 chgm-pc tssw: Upload: request POST: id 'upload' (upload.cpp:21)
>> Jul 5 10:24:51 chgm-pc tssw: upload: storing file C:Dokumente und
>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf - size:
>> 2947635 (upload.cpp:41)
>> Jul 5 10:24:51 chgm-pc tssw: upload:
>> /tmp/If37354f45a5f672658789c3a33e95e68/C:Dokumente und
>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf
>> (upload.cpp:48)
>>
>> I thought that I could filter out the substring starting from the last
>> \ in the filename, but cppcms filters away all \.
>> Is there a way to configure it or did I found a bug?
>>
>> The file looks in wireshark like:
>> C:\Dokumente und Einstellungen\gmeiner\Eigene Dateien\Download\s01_257782.pdf
>>
>
> Sooo I found the problem in cppcms-1.0.4/private/http_protocol.h:
>
>
> template<typename It>
> std::string unquote(It &begin,It end)
> {
> It p=begin;
> std::string result;
> if(p>=end || *p!='\"')
> return result;
> result.reserve(end-p);
> p++;
> while(p < end) {
> char c=*p++;
> if(c=='\"') {
> begin=p;
> return result;
> }
> else if(c=='\\' && p<end) <--
> result+= *p++; <--
> else
> result+=c;
> }
> result.clear();
> return result;
> }
>
> If I comment out the else if everything works.
>
> How shall I proceed? Send a patch?
>
> --
> Christian Gmeiner, MSc
|
|
From: Artyom B. <art...@ya...> - 2013-07-11 11:48:27
|
Yes, the problem is IE. The specifications require to parse "c:\foo\bar" as c:foobar were "\" is escape character. So there is nothing really can be done if you want to follow the standard. The second point... NEVER, EVER EVER use the provided file name for naming files... EVER. Creating file like /tmp/If37354f45a5f672658789c3a33e95e68/user-provided-name.pdf Can expose you to numerous security bugs. The trivial one is use stuff like "user-provided-name/../../../var/www/mycode.php" and save it Of course checking for ".." would not be enough as there may be many interesting stuff to handle for example on windows it may be file named "con" etc. etc. There virtually unlimited number of attacks if the user gives the name to file. So always save files with names you had generated. Artyom Beilis -------------- CppCMS - C++ Web Framework: http://cppcms.com/ CppDB - C++ SQL Connectivity: http://cppcms.com/sql/cppdb/ >________________________________ > From: Christian Gmeiner <chr...@gm...> >To: cpp...@li... >Sent: Thursday, July 11, 2013 2:21 PM >Subject: Re: [Cppcms-users] Problem with http::file and the returned file name > > >ping >-- >Christian Gmeiner, MSc > > >2013/7/5 Christian Gmeiner <chr...@gm...>: >> Hi all. >> >>> In my web application I make use of a file uploader, which works like >>> a charm. But >>> I run into this problem: >>> >>> Some older IE versions (6,7,8) are sending the full path of the uploaded file >>> in the multipart data - verified via wireshark. >>> All other browsers (chrome, ff, safari) are sending only the filename. >>> >>> This looks like: >>> >>> Jul 5 10:24:51 chgm-pc tssw: Upload: request POST: id 'upload' (upload.cpp:21) >>> Jul 5 10:24:51 chgm-pc tssw: upload: storing file C:Dokumente und >>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf - size: >>> 2947635 (upload.cpp:41) >>> Jul 5 10:24:51 chgm-pc tssw: upload: >>> /tmp/If37354f45a5f672658789c3a33e95e68/C:Dokumente und >>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf >>> (upload.cpp:48) >>> >>> I thought that I could filter out the substring starting from the last >>> \ in the filename, but cppcms filters away all \. >>> Is there a way to configure it or did I found a bug? >>> >>> The file looks in wireshark like: >>> C:\Dokumente und Einstellungen\gmeiner\Eigene Dateien\Download\s01_257782.pdf >>> >> >> Sooo I found the problem in cppcms-1.0.4/private/http_protocol.h: >> >> >> template<typename It> >> std::string unquote(It &begin,It end) >> { >> It p=begin; >> std::string result; >> if(p>=end || *p!='\"') >> return result; >> result.reserve(end-p); >> p++; >> while(p < end) { >> char c=*p++; >> if(c=='\"') { >> begin=p; >> return result; >> } >> else if(c=='\\' && p<end) <-- >> result+= *p++; <-- >> else >> result+=c; >> } >> result.clear(); >> return result; >> } >> >> If I comment out the else if everything works. >> >> How shall I proceed? Send a patch? >> >> -- >> Christian Gmeiner, MSc > >------------------------------------------------------------------------------ >See everything from the browser to the database with AppDynamics >Get end-to-end visibility with application monitoring from AppDynamics >Isolate bottlenecks and diagnose root cause in seconds. >Start your free trial of AppDynamics Pro today! >http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk >_______________________________________________ >Cppcms-users mailing list >Cpp...@li... >https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > |
|
From: Christian G. <chr...@gm...> - 2013-09-09 06:59:32
|
Hi 2013/7/11 Artyom Beilis <art...@ya...>: > Yes, the problem is IE. The specifications require to parse "c:\foo\bar" as > c:foobar were "\" is escape character. > > So there is nothing really can be done if you want to follow the standard. > > The second point... NEVER, EVER EVER use the provided file name for naming > files... EVER. > > Creating file like > /tmp/If37354f45a5f672658789c3a33e95e68/user-provided-name.pdf > > Can expose you to numerous security bugs. > > The trivial one is use stuff like > "user-provided-name/../../../var/www/mycode.php" and save it > > Of course checking for ".." would not be enough as there may be many > interesting stuff to handle for example > on windows it may be file named "con" etc. etc. There virtually unlimited > number of attacks if the user gives the name to file. > > So always save files with names you had generated. > thanks for this tipp... -- Christian Gmeiner, MSc > Artyom Beilis > -------------- > CppCMS - C++ Web Framework: http://cppcms.com/ > CppDB - C++ SQL Connectivity: http://cppcms.com/sql/cppdb/ > > ________________________________ > From: Christian Gmeiner <chr...@gm...> > To: cpp...@li... > Sent: Thursday, July 11, 2013 2:21 PM > Subject: Re: [Cppcms-users] Problem with http::file and the returned file > name > > ping > -- > Christian Gmeiner, MSc > > > 2013/7/5 Christian Gmeiner <chr...@gm...>: >> Hi all. >> >>> In my web application I make use of a file uploader, which works like >>> a charm. But >>> I run into this problem: >>> >>> Some older IE versions (6,7,8) are sending the full path of the uploaded >>> file >>> in the multipart data - verified via wireshark. >>> All other browsers (chrome, ff, safari) are sending only the filename. >>> >>> This looks like: >>> >>> Jul 5 10:24:51 chgm-pc tssw: Upload: request POST: id 'upload' >>> (upload.cpp:21) >>> Jul 5 10:24:51 chgm-pc tssw: upload: storing file C:Dokumente und >>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf - size: >>> 2947635 (upload.cpp:41) >>> Jul 5 10:24:51 chgm-pc tssw: upload: >>> /tmp/If37354f45a5f672658789c3a33e95e68/C:Dokumente und >>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf >>> (upload.cpp:48) >>> >>> I thought that I could filter out the substring starting from the last >>> \ in the filename, but cppcms filters away all \. >>> Is there a way to configure it or did I found a bug? >>> >>> The file looks in wireshark like: >>> C:\Dokumente und Einstellungen\gmeiner\Eigene >>> Dateien\Download\s01_257782.pdf >>> >> >> Sooo I found the problem in cppcms-1.0.4/private/http_protocol.h: >> >> >> template<typename It> >> std::string unquote(It &begin,It end) >> { >> It p=begin; >> std::string result; >> if(p>=end || *p!='\"') >> return result; >> result.reserve(end-p); >> p++; >> while(p < end) { >> char c=*p++; >> if(c=='\"') { >> begin=p; >> return result; >> } >> else if(c=='\\' && p<end) <-- >> result+= *p++; <-- >> else >> result+=c; >> } >> result.clear(); >> return result; >> } >> >> If I comment out the else if everything works. >> >> How shall I proceed? Send a patch? >> >> -- >> Christian Gmeiner, MSc > > ------------------------------------------------------------------------------ > See everything from the browser to the database with AppDynamics > Get end-to-end visibility with application monitoring from AppDynamics > Isolate bottlenecks and diagnose root cause in seconds. > Start your free trial of AppDynamics Pro today! > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > See everything from the browser to the database with AppDynamics > Get end-to-end visibility with application monitoring from AppDynamics > Isolate bottlenecks and diagnose root cause in seconds. > Start your free trial of AppDynamics Pro today! > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > |
