Skip to content
Permalink
Browse files

Reject file paths containing `..`.

Paths containing `..` are generally up to no good. Throw an exception,
as developers can use realpath() if they really need to get relative
paths.

Fixes #3370
  • Loading branch information...
markstory committed Apr 24, 2014
1 parent 2333c3d commit 6f68049bf507783c5f278eccbd0c807a0ecc45c3
Showing with 18 additions and 0 deletions.
  1. +7 −0 lib/Cake/Network/CakeResponse.php
  2. +11 −0 lib/Cake/Test/Case/Network/CakeResponseTest.php
@@ -1259,6 +1259,13 @@ public function file($path, $options = array()) {
'download' => null
);
if (strpos($path, '..') !== false) {
throw new NotFoundException(__d(
'cake_dev',
'The requested file contains `..` and will not be read.'
));
}
if (!is_file($path)) {
$path = APP . $path;
}
@@ -1075,6 +1075,17 @@ public function testFileNotFound() {
$response->file('/some/missing/folder/file.jpg');
}
/**
* test file with ..
*
* @expectedException NotFoundException
* @return void
*/
public function testFileWithPathTraversal() {
$response = new CakeResponse();
$response->file('my/../cat.gif');
}
/**
* testFile method
*

0 comments on commit 6f68049

Please sign in to comment.
You can’t perform that action at this time.