Re: [Cppcms-users] Problem with http::file and the returned file name

[Christian G. <chr...@gm...>]

Hi

2013/7/11 Artyom Beilis <art...@ya...>:
> Yes, the problem is IE. The specifications require to parse "c:\foo\bar" as
> c:foobar were "\" is escape character.
>
> So there is nothing really can be done if you want to follow the standard.
>
> The second point... NEVER, EVER EVER use the provided file name for naming
> files... EVER.
>
> Creating file like
> /tmp/If37354f45a5f672658789c3a33e95e68/user-provided-name.pdf
>
> Can expose you to numerous security bugs.
>
> The trivial one is use stuff like
> "user-provided-name/../../../var/www/mycode.php" and save it
>
> Of course checking for ".." would not be enough as there may be many
> interesting stuff to handle for example
> on windows it may be file named "con" etc. etc. There virtually unlimited
> number of attacks if the user gives the name to file.
>
> So always save files with names you had generated.
>

thanks for this tipp...

--
Christian Gmeiner, MSc

> Artyom Beilis
> --------------
> CppCMS - C++ Web Framework:   http://cppcms.com/
> CppDB - C++ SQL Connectivity: http://cppcms.com/sql/cppdb/
>
> ________________________________
> From: Christian Gmeiner <chr...@gm...>
> To: cpp...@li...
> Sent: Thursday, July 11, 2013 2:21 PM
> Subject: Re: [Cppcms-users] Problem with http::file and the returned file
> name
>
> ping
> --
> Christian Gmeiner, MSc
>
>
> 2013/7/5 Christian Gmeiner <chr...@gm...>:
>> Hi all.
>>
>>> In my web application I make use of a file uploader, which works like
>>> a charm. But
>>> I run into this problem:
>>>
>>> Some older IE versions (6,7,8) are sending the full path of the uploaded
>>> file
>>> in the multipart data - verified via wireshark.
>>> All other browsers (chrome, ff, safari) are sending only the filename.
>>>
>>> This looks like:
>>>
>>> Jul  5 10:24:51 chgm-pc tssw: Upload: request POST: id 'upload'
>>> (upload.cpp:21)
>>> Jul  5 10:24:51 chgm-pc tssw: upload: storing file C:Dokumente und
>>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf - size:
>>> 2947635 (upload.cpp:41)
>>> Jul  5 10:24:51 chgm-pc tssw: upload:
>>> /tmp/If37354f45a5f672658789c3a33e95e68/C:Dokumente und
>>> EinstellungengmeinerEigene DateienDownloads01_257782.pdf
>>> (upload.cpp:48)
>>>
>>> I thought that I could filter out the substring starting from the last
>>> \ in the filename, but cppcms filters away all \.
>>> Is there a way to configure it or did I found a bug?
>>>
>>> The file looks in wireshark like:
>>> C:\Dokumente und Einstellungen\gmeiner\Eigene
>>> Dateien\Download\s01_257782.pdf
>>>
>>
>> Sooo I found the problem in cppcms-1.0.4/private/http_protocol.h:
>>
>>
>> template<typename It>
>> std::string unquote(It &begin,It end)
>> {
>>        It p=begin;
>>        std::string result;
>>        if(p>=end || *p!='\"')
>>                return result;
>>        result.reserve(end-p);
>>        p++;
>>        while(p < end) {
>>                char c=*p++;
>>                if(c=='\"') {
>>                        begin=p;
>>                        return result;
>>                }
>>                else if(c=='\\' && p<end)    <--
>>                      result+= *p++;            <--
>>                else
>>                        result+=c;
>>        }
>>        result.clear();
>>        return result;
>> }
>>
>> If I comment out the else if everything works.
>>
>> How shall I proceed? Send a patch?
>>
>> --
>> Christian Gmeiner, MSc
>
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> _______________________________________________
> Cppcms-users mailing list
> Cpp...@li...
> https://lists.sourceforge.net/lists/listinfo/cppcms-users
>
>
>
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> _______________________________________________
> Cppcms-users mailing list
> Cpp...@li...
> https://lists.sourceforge.net/lists/listinfo/cppcms-users
>