taler/exchange
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

make URL joining more restrictive to avoid mistakes

Browse Source
This commit is contained in:
Florian Dold 2019-09-23 17:23:54 +02:00
parent 389b5de09d
commit 5e859bae09
No known key found for this signature in database
GPG Key ID: D2E4F00F29D02A4B
2 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/util/test_url.c
View File

@ -51,12 +51,8 @@ main (int argc,
cf (TALER_url_join ("https://taler.net/", "foo", NULL), cf (TALER_url_join ("https://taler.net/", "foo", NULL),
"https://taler.net/foo"); "https://taler.net/foo");
cf (TALER_url_join ("https://taler.net", "foo", NULL), cf (TALER_url_join ("https://taler.net/", "foo", NULL),
"https://taler.net/foo"); "https://taler.net/foo");
cf (TALER_url_join ("https://taler.net/", "/foo", NULL),
"https://taler.net/foo");
cf (TALER_url_join ("https://taler.net/", "/foo/", NULL),
"https://taler.net/foo/");
cf (TALER_url_join ("https://taler.net/", "foo", "x", "42", NULL), cf (TALER_url_join ("https://taler.net/", "foo", "x", "42", NULL),
"https://taler.net/foo?x=42"); "https://taler.net/foo?x=42");
@ -67,11 +63,11 @@ main (int argc,
cf (TALER_url_join ("https://taler.net/", "foo", "x", "", "y", "1", NULL), cf (TALER_url_join ("https://taler.net/", "foo", "x", "", "y", "1", NULL),
"https://taler.net/foo?x=&y=1"); "https://taler.net/foo?x=&y=1");
cf (TALER_url_join ("https://taler.net", "foo/bar", "x", "a&b", NULL), cf (TALER_url_join ("https://taler.net/", "foo/bar", "x", "a&b", NULL),
"https://taler.net/foo/bar?x=a%26b"); "https://taler.net/foo/bar?x=a%26b");
/* Path component is not encoded! */ /* Path component is not encoded! */
cf (TALER_url_join ("https://taler.net", "foo/bar?spam=eggs&quux=", NULL), cf (TALER_url_join ("https://taler.net/", "foo/bar?spam=eggs&quux=", NULL),
"https://taler.net/foo/bar?spam=eggs&quux="); "https://taler.net/foo/bar?spam=eggs&quux=");
cf (TALER_url_absolute_raw ("https", "taler.net", "foo/bar", "baz", cf (TALER_url_absolute_raw ("https", "taler.net", "foo/bar", "baz",

9
src/util/util.c
View File

@ -300,6 +300,15 @@ TALER_url_join (const char *base_url,
va_list args; va_list args;
GNUNET_assert (NULL != res); GNUNET_assert (NULL != res);
GNUNET_assert (NULL != base_url);
GNUNET_assert (NULL != path);
GNUNET_assert (strlen (base_url) > 0);
// Must be an actual base URL!
GNUNET_assert ('/' == base_url[strlen (base_url) - 1]);
// Path must be relative to existing path of base URL
GNUNET_assert ('/' != path[0]);
grow_string (&res, base_url, &n); grow_string (&res, base_url, &n);