squark-filter: correctly identify URLs which use ..

Previously squark-filter could be tricked into passing forbidden URLs
by using /../ in the path. This bug resulted from confusion about which
way to shrink/grow "blob" buffers in when canonicalizing URLs.

2 files changed, 9 insertions, 1 deletions

diff --git a/src/blob.c b/src/blob.c
index 196adf9..41e8d75 100644
--- a/src/blob.c
+++ b/src/blob.c
@@ -277,7 +277,8 @@ void blob_push_urldecode(blob_t *to, blob_t url)
 			/* skip '.' or two consecutive / */
 		} else if (blob_cmp(b, BLOB_STR("..")) == 0) {
 			/* go up one path component */
-			blob_shrink_tail(to, blob_pushed(orig, b), '/');
+			blob_expand_head(to, orig, '/');
+			blob_expand_head_bytes(to, 1); /* back up past the '/' separator */
 		} else {
 			/* copy decoded; FIXME decode percent encoding */
 			blob_push_byte(to, '/');
@@ -410,6 +411,12 @@ blob_t blob_expand_head(blob_t *b, blob_t limits, unsigned char sep)
 	return r;
 }
 
+void blob_expand_head_bytes(blob_t *b, int bytes)
+{
+	b->ptr -= bytes;
+	b->len += bytes;
+}
+
 blob_t blob_expand_tail(blob_t *b, blob_t limits, unsigned char sep)
 {
 	blob_t t = *b;
diff --git a/src/blob.h b/src/blob.h
index c2a394e..ff137af 100644
--- a/src/blob.h
+++ b/src/blob.h
@@ -65,5 +65,6 @@ int blob_pull_inet_addr(blob_t *b, struct in_addr *saddr);
 blob_t blob_expand_head(blob_t *b, blob_t limits, unsigned char sep);
 blob_t blob_expand_tail(blob_t *b, blob_t limits, unsigned char sep);
 blob_t blob_shrink_tail(blob_t *b, blob_t limits, unsigned char sep);
+void blob_expand_head_bytes(blob_t *b, int bytes);
 
 #endif