This repository has been archived by the owner on Dec 14, 2018. It is now read-only.
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Resolve path traversals in RazorViewEngine
This change moves the onus of path resolution from individual IFileProvider instances to RazorViewEngine. Fixes #5574 Fixes aspnet/MvcPrecompilation#33
- Loading branch information
Showing
12 changed files
with
272 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
12 changes: 12 additions & 0 deletions
12
test/WebSites/RazorWebSite/Controllers/EmbeddedViewsController.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
// Copyright (c) .NET Foundation. All rights reserved. | ||
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
||
using Microsoft.AspNetCore.Mvc; | ||
|
||
namespace RazorWebSite.Controllers | ||
{ | ||
public class EmbeddedViewsController : Controller | ||
{ | ||
public IActionResult Index() => View("/Views/EmbeddedHome/Index.cshtml"); | ||
} | ||
} |
19 changes: 19 additions & 0 deletions
19
test/WebSites/RazorWebSite/Controllers/UpdateableFileProviderController.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
// Copyright (c) .NET Foundation. All rights reserved. | ||
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
||
using Microsoft.AspNetCore.Mvc; | ||
|
||
namespace RazorWebSite | ||
{ | ||
public class UpdateableFileProviderController : Controller | ||
{ | ||
public IActionResult Index() => View("/Views/UpdateableIndex/Index.cshtml"); | ||
|
||
[HttpPost] | ||
public IActionResult Update([FromServices] UpdateableFileProvider fileProvider) | ||
{ | ||
fileProvider.UpdateContent("/Views/UpdateableShared/_Partial.cshtml", "New content"); | ||
return Ok(); | ||
} | ||
} | ||
} |
3 changes: 3 additions & 0 deletions
3
test/WebSites/RazorWebSite/EmbeddedViews/Views/EmbeddedHome/Index.cshtml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
@{ Layout = "/Views/EmbeddedShared/_Layout.cshtml"; } | ||
@Html.Partial("../EmbeddedShared/_Partial.cshtml") | ||
@Html.Partial("_EmbeddedPartial") |
1 change: 1 addition & 0 deletions
1
test/WebSites/RazorWebSite/EmbeddedViews/Views/EmbeddedShared/_Layout.cshtml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
<embdedded-layout>@RenderBody()</embdedded-layout> |
1 change: 1 addition & 0 deletions
1
test/WebSites/RazorWebSite/EmbeddedViews/Views/EmbeddedShared/_Partial.cshtml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Hello from EmbeddedShared/_Partial |
1 change: 1 addition & 0 deletions
1
test/WebSites/RazorWebSite/EmbeddedViews/Views/Shared/_EmbeddedPartial.cshtml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Hello from Shared/_EmbeddedPartial |
90 changes: 90 additions & 0 deletions
90
test/WebSites/RazorWebSite/Services/UpdateableFileProvider.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,90 @@ | ||
// Copyright (c) .NET Foundation. All rights reserved. | ||
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
||
using System; | ||
using System.Collections.Generic; | ||
using System.IO; | ||
using System.Text; | ||
using System.Threading; | ||
using Microsoft.Extensions.FileProviders; | ||
using Microsoft.Extensions.Primitives; | ||
|
||
namespace RazorWebSite | ||
{ | ||
public class UpdateableFileProvider : IFileProvider | ||
{ | ||
private readonly Dictionary<string, TestFileInfo> _content = new Dictionary<string, TestFileInfo>() | ||
{ | ||
{ | ||
"/Views/UpdateableIndex/Index.cshtml", | ||
new TestFileInfo(@"@Html.Partial(""../UpdateableShared/_Partial.cshtml"")") | ||
}, | ||
{ | ||
"/Views/UpdateableShared/_Partial.cshtml", | ||
new TestFileInfo("Original content") | ||
}, | ||
}; | ||
|
||
public IDirectoryContents GetDirectoryContents(string subpath) | ||
{ | ||
throw new NotImplementedException(); | ||
} | ||
|
||
public void UpdateContent(string subpath, string content) | ||
{ | ||
var old = _content[subpath]; | ||
old.TokenSource.Cancel(); | ||
_content[subpath] = new TestFileInfo(content); | ||
} | ||
|
||
public IFileInfo GetFileInfo(string subpath) | ||
{ | ||
TestFileInfo fileInfo; | ||
if (!_content.TryGetValue(subpath, out fileInfo)) | ||
{ | ||
fileInfo = new TestFileInfo(null); | ||
} | ||
|
||
return fileInfo; | ||
} | ||
|
||
public IChangeToken Watch(string filter) | ||
{ | ||
TestFileInfo fileInfo; | ||
if (_content.TryGetValue(filter, out fileInfo)) | ||
{ | ||
return fileInfo.ChangeToken; | ||
} | ||
|
||
return NullChangeToken.Singleton; | ||
} | ||
|
||
private class TestFileInfo : IFileInfo | ||
{ | ||
private readonly string _content; | ||
|
||
public TestFileInfo(string content) | ||
{ | ||
_content = content; | ||
ChangeToken = new CancellationChangeToken(TokenSource.Token); | ||
Exists = _content != null; | ||
} | ||
|
||
public bool Exists { get; } | ||
public bool IsDirectory => false; | ||
public DateTimeOffset LastModified => DateTimeOffset.MinValue; | ||
public long Length => -1; | ||
public string Name => null; | ||
public string PhysicalPath => null; | ||
|
||
public CancellationTokenSource TokenSource { get; } = new CancellationTokenSource(); | ||
|
||
public CancellationChangeToken ChangeToken { get; } | ||
|
||
public Stream CreateReadStream() | ||
{ | ||
return new MemoryStream(Encoding.UTF8.GetBytes(_content)); | ||
} | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters