sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

check for filename blacklist in OC_Filesystem::isValidPath

remotes/origin/stable4
Robin Appelman 2012-11-03 00:21:10 +07:00
parent 6540c0fc63
commit 4b86c43f97
2 changed files with 104 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/filesystem.php
Unescape Escape View File

@ -368,6 +368,9 @@ class OC_Filesystem{
if(strstr($path,'/../') || strrchr($path, '/') === '/..' ){ if(strstr($path,'/../') || strrchr($path, '/') === '/..' ){
return false; return false;
} }
if(self::isFileBlacklisted($path)){
return false;
}
return true; return true;
} }
@ -376,21 +379,23 @@ class OC_Filesystem{
* Listens to write and rename hooks * Listens to write and rename hooks
* @param array $data from hook * @param array $data from hook
*/ */
static public function isBlacklisted($data){ static public function isBlacklisted($data) {
$blacklist = array('.htaccess');
if (isset($data['path'])) { if (isset($data['path'])) {
$path = $data['path']; $path = $data['path'];
} else if (isset($data['newpath'])) { } else if (isset($data['newpath'])) {
$path = $data['newpath']; $path = $data['newpath'];
} }
if (isset($path)) { if (isset($path)) {
$filename = strtolower(basename($path)); $data['run'] = !self::isFileBlacklisted($path);
if (in_array($filename, $blacklist)) {
$data['run'] = false;
}
} }
} }
static public function isFileBlacklisted($path){
$blacklist = array('.htaccess');
$filename = strtolower(basename($path));
return in_array($filename, $blacklist);
}
/** /**
* following functions are equivalent to their php builtin equivalents for arguments/return values. * following functions are equivalent to their php builtin equivalents for arguments/return values.
*/ */

106
tests/lib/filesystem.php
Unescape Escape View File

@ -45,20 +45,98 @@ class Test_Filesystem extends UnitTestCase{
OC_Filesystem::clearMounts(); OC_Filesystem::clearMounts();
} }
public function testMount(){ public function testMount() {
OC_Filesystem::mount('OC_Filestorage_Local',self::getStorageData(),'/'); OC_Filesystem::mount('OC_Filestorage_Local', self::getStorageData(), '/');
$this->assertEqual('/',OC_Filesystem::getMountPoint('/')); $this->assertEqual('/', OC_Filesystem::getMountPoint('/'));
$this->assertEqual('/',OC_Filesystem::getMountPoint('/some/folder')); $this->assertEqual('/', OC_Filesystem::getMountPoint('/some/folder'));
$this->assertEqual('',OC_Filesystem::getInternalPath('/')); $this->assertEqual('', OC_Filesystem::getInternalPath('/'));
$this->assertEqual('some/folder',OC_Filesystem::getInternalPath('/some/folder')); $this->assertEqual('some/folder', OC_Filesystem::getInternalPath('/some/folder'));
OC_Filesystem::mount('OC_Filestorage_Local',self::getStorageData(),'/some'); OC_Filesystem::mount('OC_Filestorage_Local', self::getStorageData(), '/some');
$this->assertEqual('/',OC_Filesystem::getMountPoint('/')); $this->assertEqual('/', OC_Filesystem::getMountPoint('/'));
$this->assertEqual('/some/',OC_Filesystem::getMountPoint('/some/folder')); $this->assertEqual('/some/', OC_Filesystem::getMountPoint('/some/folder'));
$this->assertEqual('/some/',OC_Filesystem::getMountPoint('/some/')); $this->assertEqual('/some/', OC_Filesystem::getMountPoint('/some/'));
$this->assertEqual('/',OC_Filesystem::getMountPoint('/some')); $this->assertEqual('/', OC_Filesystem::getMountPoint('/some'));
$this->assertEqual('folder',OC_Filesystem::getInternalPath('/some/folder')); $this->assertEqual('folder', OC_Filesystem::getInternalPath('/some/folder'));
}
public function testNormalize() {
$this->assertEqual('/path', OC_Filesystem::normalizePath('/path/'));
$this->assertEqual('/path/', OC_Filesystem::normalizePath('/path/', false));
$this->assertEqual('/path', OC_Filesystem::normalizePath('path'));
$this->assertEqual('/path', OC_Filesystem::normalizePath('\path'));
$this->assertEqual('/foo/bar', OC_Filesystem::normalizePath('/foo//bar/'));
$this->assertEqual('/foo/bar', OC_Filesystem::normalizePath('/foo////bar'));
if (class_exists('Normalizer')) {
$this->assertEqual("/foo/bar\xC3\xBC", OC_Filesystem::normalizePath("/foo/baru\xCC\x88"));
}
}
public function testBlacklist() {
OC_Hook::clear('OC_Filesystem');
OC_Hook::connect('OC_Filesystem', 'write', 'OC_Filesystem', 'isBlacklisted');
OC_Hook::connect('OC_Filesystem', 'rename', 'OC_Filesystem', 'isBlacklisted');
$run = true;
OC_Hook::emit(
OC_Filesystem::CLASSNAME,
OC_Filesystem::signal_write,
array(
OC_Filesystem::signal_param_path => '/test/.htaccess',
OC_Filesystem::signal_param_run => &$run
)
);
$this->assertFalse($run);
if (OC_Filesystem::getView()) {
$user = OC_User::getUser();
} else {
$user = uniqid();
OC_Filesystem::init('/' . $user . '/files');
}
OC_Filesystem::mount('OC_Filestorage_Temporary', array(), '/');
$rootView = new OC_FilesystemView('');
$rootView->mkdir('/' . $user);
$rootView->mkdir('/' . $user . '/files');
$this->assertFalse($rootView->file_put_contents('/.htaccess', 'foo'));
$this->assertFalse(OC_Filesystem::file_put_contents('/.htaccess', 'foo'));
$fh = fopen(__FILE__, 'r');
$this->assertFalse(OC_Filesystem::file_put_contents('/.htaccess', $fh));
}
public function testHooks() {
if (OC_Filesystem::getView()) {
$user = OC_User::getUser();
} else {
$user = uniqid();
OC_Filesystem::init('/' . $user . '/files');
}
OC_Hook::clear('OC_Filesystem');
OC_Hook::connect('OC_Filesystem', 'post_write', $this, 'dummyHook');
OC_Filesystem::mount('OC_Filestorage_Temporary', array(), '/');
$rootView = new OC_FilesystemView('');
$rootView->mkdir('/' . $user);
$rootView->mkdir('/' . $user . '/files');
OC_Filesystem::file_put_contents('/foo', 'foo');
OC_Filesystem::mkdir('/bar');
OC_Filesystem::file_put_contents('/bar//foo', 'foo');
$tmpFile = OC_Helper::tmpFile();
file_put_contents($tmpFile, 'foo');
$fh = fopen($tmpFile, 'r');
OC_Filesystem::file_put_contents('/bar//foo', $fh);
}
public function dummyHook($arguments) {
$path = $arguments['path'];
$this->assertEqual($path, OC_Filesystem::normalizePath($path)); //the path passed to the hook should already be normalized
} }
} }
?> ?>