X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=networking%2Fhttpd_indexcgi.c;h=562cd7fbef495b0102763bf032cb5134833937b4;hb=e695ac97fdd48808dd0a84d4725a063481a03c30;hp=7e0225e198722effa488c3c213c4a5ed4f224613;hpb=0ef64bdb40c54681e8dd5ab8df42ac88e4ab1d4a;p=oweals%2Fbusybox.git diff --git a/networking/httpd_indexcgi.c b/networking/httpd_indexcgi.c index 7e0225e19..562cd7fbe 100644 --- a/networking/httpd_indexcgi.c +++ b/networking/httpd_indexcgi.c @@ -35,6 +35,7 @@ httpd_indexcgi.c -o index.cgi * 2576 4 2048 4628 1214 index.cgi.o */ +#define _GNU_SOURCE 1 /* for strchrnul */ #include #include #include @@ -221,20 +222,25 @@ int main(int argc, char *argv[]) unsigned long long size_total; int odd; DIR *dirp; - char *QUERY_STRING; - - QUERY_STRING = getenv("QUERY_STRING"); - if (!QUERY_STRING - || QUERY_STRING[0] != '/' - || strstr(QUERY_STRING, "//") - || strstr(QUERY_STRING, "/../") - || strcmp(strrchr(QUERY_STRING, '/'), "/..") == 0 + char *location; + + location = getenv("REQUEST_URI"); + if (!location) + return 1; + + /* drop URL arguments if any */ + strchrnul(location, '?')[0] = '\0'; + + if (location[0] != '/' + || strstr(location, "//") + || strstr(location, "/../") + || strcmp(strrchr(location, '/'), "/..") == 0 ) { return 1; } if (chdir("..") - || (QUERY_STRING[1] && chdir(QUERY_STRING + 1)) + || (location[1] && chdir(location + 1)) ) { return 1; } @@ -271,14 +277,14 @@ int main(int argc, char *argv[]) "\r\n" /* Mandatory empty line after headers */ "Index of "); /* Guard against directories with &, > etc */ - fmt_html(QUERY_STRING); + fmt_html(location); fmt_str( "\n" STYLE_STR "" "\n" "" "\n" "

Index of "); - fmt_html(QUERY_STRING); + fmt_html(location); fmt_str( "

" "\n" "" "\n"