Don't load classnames with .. in their names.

Classnames with . in them are invalid and can be leveraged to load code outside of an application by traversing directories.
cakephp · Jul 2, 2013 · 9754789 · 9754789
1 parent da033cb
commit 9754789
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/Cake/Core/App.php b/lib/Cake/Core/App.php
@@ -535,6 +535,9 @@ public static function load($className) {
 		if (!isset(self::$_classMap[$className])) {
 			return false;
 		}
+		if (strpos($className, '..')) {
+			return false;
+		}
 
 		$parts = explode('.', self::$_classMap[$className], 2);
 		list($plugin, $package) = count($parts) > 1 ? $parts : array(null, current($parts));