Bug 544990: Allow directory names in page.cgi ids

r=LpSolit, a=mkanat

Bug 544990: Allow directory names in page.cgi ids
300f1db2 · Max Kanat-Alexander · 55179a93 · 300f1db2
Commit 300f1db2 authored Feb 08, 2010 by Max Kanat-Alexander
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 3 deletions

page.cgi page.cgi +3 -3

No files found.
--- a/page.cgi
+++ b/page.cgi
@@ -66,9 +66,9 @@ my $template = Bugzilla->template;

 my $id = $cgi->param('id');
 if ($id) {
-    # Remove all dodgy chars, and split into name and ctype.
-    $id =~ s/[^\w\-\.]//g;
-    $id =~ /(.*)\.(.*)/;
+    # Split into name and ctype, but be careful not to allow directory
+    # traversal.
+    $id =~ /^([\w\-\/]+)\.(\w+)$/;
    if (!$2) {
        # if this regexp fails to match completely, something bad came in
        ThrowCodeError("bad_page_cgi_id", { "page_id" => $id });