summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ufilter.c78
1 files changed, 39 insertions, 39 deletions
diff --git a/ufilter.c b/ufilter.c
index cb36a67..b7543ea 100644
--- a/ufilter.c
+++ b/ufilter.c
@@ -18,7 +18,7 @@
18 +----------------------------------------------------------------------+ 18 +----------------------------------------------------------------------+
19*/ 19*/
20/* 20/*
21 $Id: ufilter.c,v 1.1.1.1 2007-11-28 01:15:35 sesser Exp $ 21 $Id: ufilter.c,v 1.1.1.1 2007-11-28 01:15:35 sesser Exp $
22*/ 22*/
23 23
24#ifdef HAVE_CONFIG_H 24#ifdef HAVE_CONFIG_H
@@ -36,7 +36,7 @@
36// #if !HAVE_RFC1867_CALLBACK 36// #if !HAVE_RFC1867_CALLBACK
37// PHP_SUHOSIN_API int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra) = NULL; 37// PHP_SUHOSIN_API int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra) = NULL;
38// #endif 38// #endif
39// 39//
40 40
41/* {{{ SAPI_UPLOAD_VARNAME_FILTER_FUNC 41/* {{{ SAPI_UPLOAD_VARNAME_FILTER_FUNC
42 */ 42 */
@@ -49,12 +49,12 @@ static int check_fileupload_varname(char *varname)
49 49
50 /* Normalize the variable name */ 50 /* Normalize the variable name */
51 suhosin_normalize_varname(var); 51 suhosin_normalize_varname(var);
52 52
53 /* Find length of variable name */ 53 /* Find length of variable name */
54 index = strchr(var, '['); 54 index = strchr(var, '[');
55 total_len = strlen(var); 55 total_len = strlen(var);
56 var_len = index ? index-var : total_len; 56 var_len = index ? index-var : total_len;
57 57
58 /* Drop this variable if it exceeds the varname/total length limit */ 58 /* Drop this variable if it exceeds the varname/total length limit */
59 if (SUHOSIN7_G(max_varname_length) && SUHOSIN7_G(max_varname_length) < var_len) { 59 if (SUHOSIN7_G(max_varname_length) && SUHOSIN7_G(max_varname_length) < var_len) {
60 suhosin_log(S_FILES, "configured request variable name length limit exceeded - dropped variable '%s'", var); 60 suhosin_log(S_FILES, "configured request variable name length limit exceeded - dropped variable '%s'", var);
@@ -80,38 +80,38 @@ static int check_fileupload_varname(char *varname)
80 goto return_failure; 80 goto return_failure;
81 } 81 }
82 } 82 }
83 83
84 /* Find out array depth */ 84 /* Find out array depth */
85 while (index) { 85 while (index) {
86 char *index_end; 86 char *index_end;
87 unsigned int index_length; 87 unsigned int index_length;
88 88
89 /* overjump '[' */ 89 /* overjump '[' */
90 index++; 90 index++;
91 91
92 /* increase array depth */ 92 /* increase array depth */
93 depth++; 93 depth++;
94 94
95 index_end = strchr(index, ']'); 95 index_end = strchr(index, ']');
96 if (index_end == NULL) { 96 if (index_end == NULL) {
97 index_end = index+strlen(index); 97 index_end = index+strlen(index);
98 } 98 }
99 99
100 index_length = index_end - index; 100 index_length = index_end - index;
101 101
102 if (SUHOSIN7_G(max_array_index_length) && SUHOSIN7_G(max_array_index_length) < index_length) { 102 if (SUHOSIN7_G(max_array_index_length) && SUHOSIN7_G(max_array_index_length) < index_length) {
103 suhosin_log(S_FILES, "configured request variable array index length limit exceeded - dropped variable '%s'", var); 103 suhosin_log(S_FILES, "configured request variable array index length limit exceeded - dropped variable '%s'", var);
104 if (!SUHOSIN7_G(simulation)) { 104 if (!SUHOSIN7_G(simulation)) {
105 goto return_failure; 105 goto return_failure;
106 } 106 }
107 } 107 }
108 if (SUHOSIN7_G(max_post_array_index_length) && SUHOSIN7_G(max_post_array_index_length) < index_length) { 108 if (SUHOSIN7_G(max_post_array_index_length) && SUHOSIN7_G(max_post_array_index_length) < index_length) {
109 suhosin_log(S_FILES, "configured POST variable array index length limit exceeded - dropped variable '%s'", var); 109 suhosin_log(S_FILES, "configured POST variable array index length limit exceeded - dropped variable '%s'", var);
110 if (!SUHOSIN7_G(simulation)) { 110 if (!SUHOSIN7_G(simulation)) {
111 goto return_failure; 111 goto return_failure;
112 } 112 }
113 } 113 }
114 114
115 /* index whitelist/blacklist */ 115 /* index whitelist/blacklist */
116 if (SUHOSIN7_G(array_index_whitelist) && *(SUHOSIN7_G(array_index_whitelist))) { 116 if (SUHOSIN7_G(array_index_whitelist) && *(SUHOSIN7_G(array_index_whitelist))) {
117 if (suhosin_strnspn(index, index_length, SUHOSIN7_G(array_index_whitelist)) != index_length) { 117 if (suhosin_strnspn(index, index_length, SUHOSIN7_G(array_index_whitelist)) != index_length) {
@@ -128,11 +128,11 @@ static int check_fileupload_varname(char *varname)
128 } 128 }
129 } 129 }
130 } 130 }
131 131
132 132
133 index = strchr(index, '['); 133 index = strchr(index, '[');
134 } 134 }
135 135
136 /* Drop this variable if it exceeds the array depth limit */ 136 /* Drop this variable if it exceeds the array depth limit */
137 if (SUHOSIN7_G(max_array_depth) && SUHOSIN7_G(max_array_depth) < depth) { 137 if (SUHOSIN7_G(max_array_depth) && SUHOSIN7_G(max_array_depth) < depth) {
138 suhosin_log(S_FILES, "configured request variable array depth limit exceeded - dropped variable '%s'", var); 138 suhosin_log(S_FILES, "configured request variable array depth limit exceeded - dropped variable '%s'", var);
@@ -146,8 +146,8 @@ static int check_fileupload_varname(char *varname)
146 goto return_failure; 146 goto return_failure;
147 } 147 }
148 } 148 }
149 149
150 150
151 /* Drop this variable if it is one of GLOBALS, _GET, _POST, ... */ 151 /* Drop this variable if it is one of GLOBALS, _GET, _POST, ... */
152 /* This is to protect several silly scripts that do globalizing themself */ 152 /* This is to protect several silly scripts that do globalizing themself */
153 if (suhosin_is_protected_varname(var, var_len)) { 153 if (suhosin_is_protected_varname(var, var_len)) {
@@ -159,10 +159,10 @@ static int check_fileupload_varname(char *varname)
159 159
160 efree(var); 160 efree(var);
161 return SUCCESS; 161 return SUCCESS;
162 162
163return_failure: 163return_failure:
164 efree(var); 164 efree(var);
165 return FAILURE; 165 return FAILURE;
166} 166}
167/* }}} */ 167/* }}} */
168 168
@@ -203,13 +203,13 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
203 switch (event) { 203 switch (event) {
204 case MULTIPART_EVENT_START: 204 case MULTIPART_EVENT_START:
205 case MULTIPART_EVENT_FORMDATA: 205 case MULTIPART_EVENT_FORMDATA:
206 /* nothing todo */ 206 /* nothing to do */
207 break; 207 break;
208 208
209 case MULTIPART_EVENT_FILE_START: 209 case MULTIPART_EVENT_FILE_START:
210 { 210 {
211 multipart_event_file_start *mefs = (multipart_event_file_start *) event_data; 211 multipart_event_file_start *mefs = (multipart_event_file_start *) event_data;
212 212
213 /* Drop if no more variables flag is set */ 213 /* Drop if no more variables flag is set */
214 if (SUHOSIN7_G(no_more_uploads)) { 214 if (SUHOSIN7_G(no_more_uploads)) {
215 goto continue_with_failure; 215 goto continue_with_failure;
@@ -247,7 +247,7 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
247 } 247 }
248 248
249 if (SUHOSIN7_G(upload_disallow_binary)) { 249 if (SUHOSIN7_G(upload_disallow_binary)) {
250 250
251 multipart_event_file_data *mefd = (multipart_event_file_data *) event_data; 251 multipart_event_file_data *mefd = (multipart_event_file_data *) event_data;
252 252
253 char *cp, *cpend; 253 char *cp, *cpend;
@@ -275,11 +275,11 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
275 } 275 }
276 276
277 if (SUHOSIN7_G(upload_remove_binary)) { 277 if (SUHOSIN7_G(upload_remove_binary)) {
278 278
279 multipart_event_file_data *mefd = (multipart_event_file_data *) event_data; 279 multipart_event_file_data *mefd = (multipart_event_file_data *) event_data;
280 size_t i, j; 280 size_t i, j;
281 int n; 281 int n;
282 282
283 for (i=0, j=0; i<mefd->length; i++) { 283 for (i=0, j=0; i<mefd->length; i++) {
284 if (mefd->data[i] >= 32 || isspace(mefd->data[i])) { 284 if (mefd->data[i] >= 32 || isspace(mefd->data[i])) {
285 mefd->data[j++] = mefd->data[i]; 285 mefd->data[j++] = mefd->data[i];
@@ -296,7 +296,7 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
296#endif 296#endif
297 } 297 }
298 mefd->data[j] = '\0'; 298 mefd->data[j] = '\0';
299 299
300 SDEBUG("removing binary %zu %zu",i,j); 300 SDEBUG("removing binary %zu %zu",i,j);
301 /* IMPORTANT FOR DAISY CHAINING */ 301 /* IMPORTANT FOR DAISY CHAINING */
302 mefd->length = j; 302 mefd->length = j;
@@ -304,11 +304,11 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
304 *mefd->newlength = j; 304 *mefd->newlength = j;
305 } 305 }
306 } 306 }
307 307
308 break; 308 break;
309 309
310 case MULTIPART_EVENT_FILE_END: 310 case MULTIPART_EVENT_FILE_END:
311 311
312 if (SUHOSIN7_G(upload_verification_script)) { 312 if (SUHOSIN7_G(upload_verification_script)) {
313 multipart_event_file_end *mefe = (multipart_event_file_end *) event_data; 313 multipart_event_file_end *mefe = (multipart_event_file_end *) event_data;
314 char cmd[8192]; 314 char cmd[8192];
@@ -316,19 +316,19 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
316 int first=1; 316 int first=1;
317 struct stat st; 317 struct stat st;
318 char *sname = SUHOSIN7_G(upload_verification_script); 318 char *sname = SUHOSIN7_G(upload_verification_script);
319 319
320 /* ignore files that will get deleted anyway */ 320 /* ignore files that will get deleted anyway */
321 if (mefe->cancel_upload) { 321 if (mefe->cancel_upload) {
322 break; 322 break;
323 } 323 }
324 324
325 /* ignore empty scriptnames */ 325 /* ignore empty scriptnames */
326 while (isspace(*sname)) ++sname; 326 while (isspace(*sname)) ++sname;
327 if (*sname == 0) { 327 if (*sname == 0) {
328 SUHOSIN7_G(num_uploads)++; 328 SUHOSIN7_G(num_uploads)++;
329 break; 329 break;
330 } 330 }
331 331
332 if (VCWD_STAT(sname, &st) < 0) { 332 if (VCWD_STAT(sname, &st) < 0) {
333 suhosin_log(S_FILES, "unable to find fileupload verification script %s - file dropped", sname); 333 suhosin_log(S_FILES, "unable to find fileupload verification script %s - file dropped", sname);
334 if (!SUHOSIN7_G(simulation)) { 334 if (!SUHOSIN7_G(simulation)) {
@@ -345,7 +345,7 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
345 goto continue_with_next; 345 goto continue_with_next;
346 } 346 }
347 } 347 }
348 348
349 ap_php_snprintf(cmd, sizeof(cmd), "%s %s 2>&1", sname, mefe->temp_filename); 349 ap_php_snprintf(cmd, sizeof(cmd), "%s %s 2>&1", sname, mefe->temp_filename);
350 350
351 if ((in = VCWD_POPEN(cmd, "r")) == NULL) { 351 if ((in = VCWD_POPEN(cmd, "r")) == NULL) {
@@ -356,9 +356,9 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
356 goto continue_with_next; 356 goto continue_with_next;
357 } 357 }
358 } 358 }
359 359
360 retval = FAILURE; 360 retval = FAILURE;
361 361
362 /* read and forget the result */ 362 /* read and forget the result */
363 while (1) { 363 while (1) {
364 int readbytes = fread(cmd, 1, sizeof(cmd), in); 364 int readbytes = fread(cmd, 1, sizeof(cmd), in);
@@ -394,14 +394,14 @@ int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
394 break; 394 break;
395 395
396 case MULTIPART_EVENT_END: 396 case MULTIPART_EVENT_END:
397 /* nothing todo */ 397 /* nothing to do */
398 break; 398 break;
399 399
400 default: 400 default:
401 /* unknown: return failure */ 401 /* unknown: return failure */
402 goto continue_with_failure; 402 goto continue_with_failure;
403 } 403 }
404continue_with_next: 404continue_with_next:
405// #if HAVE_RFC1867_CALLBACK 405// #if HAVE_RFC1867_CALLBACK
406 if (php_rfc1867_callback != NULL) { 406 if (php_rfc1867_callback != NULL) {
407 return php_rfc1867_callback(event, event_data, extra); 407 return php_rfc1867_callback(event, event_data, extra);
@@ -409,7 +409,7 @@ continue_with_next:
409// #endif 409// #endif
410 return SUCCESS; 410 return SUCCESS;
411continue_with_failure: 411continue_with_failure:
412 SUHOSIN7_G(abort_request) = 1; 412 SUHOSIN7_G(abort_request) = 1;
413 return FAILURE; 413 return FAILURE;
414} 414}
415 415