From 508ca0df3999fdc023e66bb176a36b5dd040b538 Mon Sep 17 00:00:00 2001 From: "roberto@precise64" Date: Wed, 21 Mar 2012 19:28:24 +0100 Subject: [PATCH] add realpath() for php DOCUMENT_ROOT --- plugins/php/php_plugin.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/plugins/php/php_plugin.c b/plugins/php/php_plugin.c index bdbcc490..acb017eb 100644 --- a/plugins/php/php_plugin.c +++ b/plugins/php/php_plugin.c @@ -707,13 +707,30 @@ int uwsgi_php_request(struct wsgi_request *wsgi_req) { if (uphp.docroot) { wsgi_req->document_root = uphp.docroot; - wsgi_req->document_root_len = strlen(wsgi_req->document_root); } // fallback to cwd else if (!wsgi_req->document_root_len) { wsgi_req->document_root = uwsgi.cwd; - wsgi_req->document_root_len = strlen(uwsgi.cwd); } + else { + // explode DOCUMENT_ROOT (both for security and sanity checks) + char *zeroed_docroot = uwsgi_malloc(wsgi_req->document_root_len+1); + memcpy(zeroed_docroot, wsgi_req->document_root, wsgi_req->document_root_len); + zeroed_docroot[wsgi_req->document_root_len] = 0; + // this memory will be cleared on request end + char *sanitized_docroot = ecalloc(1, PATH_MAX+1); + if (!realpath(zeroed_docroot, sanitized_docroot)) { + uwsgi_error("realpath()"); + free(zeroed_docroot); + efree(sanitized_docroot); + return -1; + } + free(zeroed_docroot); + wsgi_req->document_root = sanitized_docroot; + } + + // fix document_root_len + wsgi_req->document_root_len = strlen(wsgi_req->document_root); if (uphp.app) { strcpy(real_filename, uphp.app);