Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/clean path #45

Merged
merged 5 commits into from
Mar 2, 2022
Merged

Fix/clean path #45

merged 5 commits into from
Mar 2, 2022

Conversation

nibra
Copy link
Contributor

@nibra nibra commented Mar 3, 2021

Feature - check path length

Related to joomla/joomla-cms#32567

src/InputFilter.php Outdated Show resolved Hide resolved
@GeraintEdwards
Copy link

@nibra

With respect to my issue #51 - all the valid paths listed in my issue pass through cleanly with this new code. So this code works better than the current code in my view.

BUT note that double dotted folders such as

/var/www/vhosts/mainsite/../../another.website.net/something

still pass through unaffected - not sure what the intention is with the filtering as I've not seen the security bulletin

@nibra
Copy link
Contributor Author

nibra commented Mar 2, 2022

BUT note that double dotted folders such as

/var/www/vhosts/mainsite/../../another.website.net/something

still pass through unaffected - not sure what the intention is with the filtering as I've not seen the security bulletin

That is intended. A filter should not interpret the content, in this case resolve paths. That is up to the filesystem package.

@nibra nibra merged commit f4be050 into joomla-framework:1.x-dev Mar 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants