richardphibel / rpms / librepo

Forked from rpms/librepo 2 years ago
Clone
4e8b7c
From 699d3ee7b8968b5586ceb53e07d678e702735609 Mon Sep 17 00:00:00 2001
4e8b7c
From: Jaroslav Rohel <jrohel@redhat.com>
4e8b7c
Date: Wed, 12 Aug 2020 08:35:28 +0200
4e8b7c
Subject: [PATCH] Validate path read from repomd.xml
4e8b7c
4e8b7c
---
4e8b7c
 librepo/yum.c | 17 +++++++++++++++++
4e8b7c
 1 file changed, 17 insertions(+)
4e8b7c
4e8b7c
diff --git a/librepo/yum.c b/librepo/yum.c
4e8b7c
index 3059188..529257b 100644
4e8b7c
--- a/librepo/yum.c
4e8b7c
+++ b/librepo/yum.c
4e8b7c
@@ -23,6 +23,7 @@
4e8b7c
 #define  BITS_IN_BYTE 8
4e8b7c
 
4e8b7c
 #include <stdio.h>
4e8b7c
+#include <libgen.h>
4e8b7c
 #include <assert.h>
4e8b7c
 #include <stdlib.h>
4e8b7c
 #include <errno.h>
4e8b7c
@@ -770,6 +771,22 @@ prepare_repo_download_targets(LrHandle *handle,
4e8b7c
             continue;
4e8b7c
 
4e8b7c
         char *location_href = record->location_href;
4e8b7c
+
4e8b7c
+        char *dest_dir = realpath(handle->destdir, NULL);
4e8b7c
+        path = lr_pathconcat(handle->destdir, record->location_href, NULL);
4e8b7c
+        char *requested_dir = realpath(dirname(path), NULL);
4e8b7c
+        lr_free(path);
4e8b7c
+        if (!g_str_has_prefix(requested_dir, dest_dir)) {
4e8b7c
+            g_debug("%s: Invalid path: %s", __func__, location_href);
4e8b7c
+            g_set_error(err, LR_YUM_ERROR, LRE_IO, "Invalid path: %s", location_href);
4e8b7c
+            g_slist_free_full(*targets, (GDestroyNotify) lr_downloadtarget_free);
4e8b7c
+            free(requested_dir);
4e8b7c
+            free(dest_dir);
4e8b7c
+            return FALSE;
4e8b7c
+        }
4e8b7c
+        free(requested_dir);
4e8b7c
+        free(dest_dir);
4e8b7c
+
4e8b7c
         gboolean is_zchunk = FALSE;
4e8b7c
         #ifdef WITH_ZCHUNK
4e8b7c
         if (handle->cachedir && record->header_checksum)
4e8b7c
-- 
4e8b7c
2.28.0
4e8b7c