From af964e8929407c43e6c45c2bd3f1a0c534b2f0cc Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Sat, 26 Dec 2009 02:07:44 +0100 Subject: uri: added function uri_safe_local() --- src/uri.c | 30 ++++++++++++++++++++++++++++++ src/uri.h | 12 ++++++++++++ 2 files changed, 42 insertions(+) diff --git a/src/uri.c b/src/uri.c index 41a613de7..3e622de3b 100644 --- a/src/uri.c +++ b/src/uri.c @@ -22,6 +22,7 @@ #include +#include #include bool uri_has_scheme(const char *uri) @@ -45,6 +46,35 @@ uri_get_suffix(const char *uri) return suffix; } +static const char * +verify_uri_segment(const char *p) +{ + const char *q; + + if (*p == 0 || *p == '/' || *p == '.') + return NULL; + + q = strchr(p + 1, '/'); + return q != NULL ? q : ""; +} + +bool +uri_safe_local(const char *uri) +{ + while (true) { + uri = verify_uri_segment(uri); + if (uri == NULL) + return false; + + if (*uri == 0) + return true; + + assert(*uri == '/'); + + ++uri; + } +} + char * uri_remove_auth(const char *uri) { diff --git a/src/uri.h b/src/uri.h index 46d36308b..857080f84 100644 --- a/src/uri.h +++ b/src/uri.h @@ -35,6 +35,18 @@ G_GNUC_PURE const char * uri_get_suffix(const char *uri); +/** + * Returns true if this is a safe "local" URI: + * + * - non-empty + * - does not begin or end with a slash + * - no double slashes + * - no path component begins with a dot + */ +G_GNUC_PURE +bool +uri_safe_local(const char *uri); + /** * Removes HTTP username and password from the URI. This may be * useful for displaying an URI without disclosing secrets. Returns -- cgit v1.2.3