summaryrefslogtreecommitdiff
path: root/networking/httpd_indexcgi.c
diff options
context:
space:
mode:
authorDenys Vlasenko2011-12-19 12:30:34 +0100
committerDenys Vlasenko2011-12-19 12:30:34 +0100
commit03419aa037ce37d1c3accb0df52fdc456b360541 (patch)
tree6f96d1d0bdaafd2e197c9651dde789a8451c09b9 /networking/httpd_indexcgi.c
parent93b4a605263612cf32ad9de746a4fafaf4515115 (diff)
downloadbusybox-03419aa037ce37d1c3accb0df52fdc456b360541.zip
busybox-03419aa037ce37d1c3accb0df52fdc456b360541.tar.gz
httpd: don't drop/abuse QUERY_STRING when /cgi-bin/index.cgi is used
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk> Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'networking/httpd_indexcgi.c')
-rw-r--r--networking/httpd_indexcgi.c27
1 files changed, 16 insertions, 11 deletions
diff --git a/networking/httpd_indexcgi.c b/networking/httpd_indexcgi.c
index 7e0225e..d732cd4 100644
--- a/networking/httpd_indexcgi.c
+++ b/networking/httpd_indexcgi.c
@@ -221,20 +221,25 @@ int main(int argc, char *argv[])
unsigned long long size_total;
int odd;
DIR *dirp;
- char *QUERY_STRING;
-
- QUERY_STRING = getenv("QUERY_STRING");
- if (!QUERY_STRING
- || QUERY_STRING[0] != '/'
- || strstr(QUERY_STRING, "//")
- || strstr(QUERY_STRING, "/../")
- || strcmp(strrchr(QUERY_STRING, '/'), "/..") == 0
+ char *location;
+
+ location = getenv("REQUEST_URI");
+ if (!location)
+ return 1;
+
+ /* drop URL arguments if any */
+ strchrnul(location, '?')[0] = '\0';
+
+ if (location[0] != '/'
+ || strstr(location, "//")
+ || strstr(location, "/../")
+ || strcmp(strrchr(location, '/'), "/..") == 0
) {
return 1;
}
if (chdir("..")
- || (QUERY_STRING[1] && chdir(QUERY_STRING + 1))
+ || (location[1] && chdir(location + 1))
) {
return 1;
}
@@ -271,14 +276,14 @@ int main(int argc, char *argv[])
"\r\n" /* Mandatory empty line after headers */
"<html><head><title>Index of ");
/* Guard against directories with &, > etc */
- fmt_html(QUERY_STRING);
+ fmt_html(location);
fmt_str(
"</title>\n"
STYLE_STR
"</head>" "\n"
"<body>" "\n"
"<h1>Index of ");
- fmt_html(QUERY_STRING);
+ fmt_html(location);
fmt_str(
"</h1>" "\n"
"<table>" "\n"