Treat backslash as a path separator in XModem filename validation (#11085)
This commit is contained in:
co-authored by
GitHub
parent
19ddadf3ff
commit
ba8b1b1038
+4
-1
@@ -62,10 +62,13 @@ bool XModemAdapter::isValidFilename(const char *name)
|
||||
{
|
||||
if (!name || name[0] == '\0')
|
||||
return false;
|
||||
const bool driveLetter = (name[0] >= 'A' && name[0] <= 'Z') || (name[0] >= 'a' && name[0] <= 'z');
|
||||
if (driveLetter && name[1] == ':')
|
||||
return false;
|
||||
// Reject any ".." path component. Absolute paths and subdirectories are fine; they stay within
|
||||
// the filesystem root, so only traversal out of it needs blocking.
|
||||
for (const char *seg = name; *seg;) {
|
||||
const char *slash = strchr(seg, '/');
|
||||
const char *slash = strpbrk(seg, "/\\");
|
||||
const size_t len = slash ? (size_t)(slash - seg) : strlen(seg);
|
||||
if (len == 2 && seg[0] == '.' && seg[1] == '.')
|
||||
return false;
|
||||
|
||||
Reference in New Issue
Block a user