[FIX/WIP] Try fixing sanitisation issue

This commit is contained in:
lda 2024-05-25 18:07:44 +02:00
parent 346b912a06
commit 102ea9409d

View file

@ -218,19 +218,38 @@ DbHashKey(Array * args)
return str; return str;
} }
static char
DbSanitiseChar(char input)
{
switch (input)
{
case '/':
return '_';
case '.':
return '-';
}
return input;
}
static char * static char *
DbDirName(Db * db, Array * args, size_t strip) DbDirName(Db * db, Array * args, size_t strip)
{ {
size_t i; size_t i, j;
char *str = StrConcat(2, db->dir, "/"); char *str = StrConcat(2, db->dir, "/");
for (i = 0; i < ArraySize(args) - strip; i++) for (i = 0; i < ArraySize(args) - strip; i++)
{ {
char *tmp; char *tmp;
char *sanitise = ArrayGet(args, i);
for (j = 0; j < strlen(sanitise); j++)
{
sanitise[j] = DbSanitiseChar(sanitise[j]);
}
tmp = StrConcat(3, str, ArrayGet(args, i), "/"); tmp = StrConcat(3, str, sanitise, "/");
Free(str); Free(str);
Free(sanitise);
str = tmp; str = tmp;
} }
@ -253,17 +272,7 @@ DbFileName(Db * db, Array * args)
/* Sanitize name to prevent directory traversal attacks */ /* Sanitize name to prevent directory traversal attacks */
while (arg[j]) while (arg[j])
{ {
switch (arg[j]) arg[j] = DbSanitiseChar(arg[j]);
{
case '/':
arg[j] = '_';
break;
case '.':
arg[j] = '-';
break;
default:
break;
}
j++; j++;
} }