More specific path traversal check.

refs #7260
cakephp · Oct 17, 2015 · 0fd4189 · 0fd4189
1 parent 9dcda9b
commit 0fd4189
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 3 deletions.
diff --git a/src/Network/Response.php b/src/Network/Response.php
@@ -1422,7 +1422,7 @@ public function file($path, array $options = [])
             'download' => null
         ];
 
-        if (strpos(dirname($path), '..') !== false) {
+        if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
             throw new NotFoundException('The requested file contains `..` and will not be read.');
         }
 

diff --git a/tests/TestCase/Network/ResponseTest.php b/tests/TestCase/Network/ResponseTest.php
@@ -1156,17 +1156,30 @@ public function testFileNotFound()
     }
 
     /**
-     * test file with ..
+     * test file with ../
      *
      * @expectedException \Cake\Network\Exception\NotFoundException
      * @expectedExceptionMessage The requested file contains `..` and will not be read.
      * @return void
      */
-    public function testFileWithPathTraversal()
+    public function testFileWithForwardSlashPathTraversal()
     {
         $response = new Response();
         $response->file('my/../cat.gif');
     }
+
+    /**
+     * test file with ..\
+     *
+     * @expectedException \Cake\Network\Exception\NotFoundException
+     * @expectedExceptionMessage The requested file contains `..` and will not be read.
+     * @return void
+     */
+    public function testFileWithBackwardSlashPathTraversal() {
+        $response = new Response();
+        $response->file('my\..\cat.gif');
+    }
+
     /**
      * test file with ..
      *