diff options
Diffstat (limited to 'src/http')
| -rw-r--r-- | src/http/ngx_http_parse.c | 20 | ||||
| -rw-r--r-- | src/http/ngx_http_request.c | 28 |
2 files changed, 42 insertions, 6 deletions
diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c index 0a10a340e..be750edd0 100644 --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c @@ -543,6 +543,13 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b) switch (ch) { case '/': +#if (NGX_WIN32) + if (r->uri_ext == p) { + r->complex_uri = 1; + state = sw_uri; + break; + } +#endif r->uri_ext = NULL; state = sw_after_slash_in_uri; break; @@ -1117,6 +1124,12 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes) switch(ch) { #if (NGX_WIN32) case '\\': + if (u - 2 >= r->uri.data + && *(u - 1) == '.' && *(u - 2) != '.') + { + u--; + } + r->uri_ext = NULL; if (p == r->uri_start + r->uri.len) { @@ -1134,6 +1147,13 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes) break; #endif case '/': +#if (NGX_WIN32) + if (u - 2 >= r->uri.data + && *(u - 1) == '.' && *(u - 2) != '.') + { + u--; + } +#endif r->uri_ext = NULL; state = sw_slash; *u++ = ch; diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 06f89d648..b1877131c 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -812,7 +812,28 @@ ngx_http_process_request_line(ngx_event_t *rev) #if (NGX_WIN32) { - u_char *p; + u_char *p, *last; + + p = r->uri.data; + last = r->uri.data + r->uri.len; + + while (p < last) { + + if (*p++ == ':') { + + /* + * this check covers "::$data", "::$index_allocation" and + * ":$i30:$index_allocation" + */ + + if (p < last && *p == '$') { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent unsafe win32 URI"); + ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); + return; + } + } + } p = r->uri.data + r->uri.len - 1; @@ -828,11 +849,6 @@ ngx_http_process_request_line(ngx_event_t *rev) continue; } - if (ngx_strncasecmp(p - 6, (u_char *) "::$data", 7) == 0) { - p -= 7; - continue; - } - break; } |