Author: toad
Date: 2006-12-07 21:24:30 +0000 (Thu, 07 Dec 2006)
New Revision: 11290
Modified:
trunk/freenet/src/freenet/clients/http/filter/FilterCallback.java
trunk/freenet/src/freenet/clients/http/filter/GenericReadFilterCallback.java
trunk/freenet/src/freenet/clients/http/filter/HTMLFilter.java
Log:
Allow freesites to post to plugins.
External sites can do this, after all.. so it's not a great security risk.
Any dangerous operations should 1) be POSTs and 2) be confirmed via the
formPassword (which isn't known to either external sites or freesite authors).
Modified: trunk/freenet/src/freenet/clients/http/filter/FilterCallback.java
===================================================================
--- trunk/freenet/src/freenet/clients/http/filter/FilterCallback.java
2006-12-07 21:08:20 UTC (rev 11289)
+++ trunk/freenet/src/freenet/clients/http/filter/FilterCallback.java
2006-12-07 21:24:30 UTC (rev 11290)
@@ -32,7 +32,8 @@
* @param method The form sending method. Normally GET or POST.
* @param action The URI to send the form to.
* @return The new action URI, or null if the form is not allowed.
+ * @throws CommentException
*/
- public String processForm(String method, String action);
+ public String processForm(String method, String action) throws
CommentException;
}
Modified:
trunk/freenet/src/freenet/clients/http/filter/GenericReadFilterCallback.java
===================================================================
---
trunk/freenet/src/freenet/clients/http/filter/GenericReadFilterCallback.java
2006-12-07 21:08:20 UTC (rev 11289)
+++
trunk/freenet/src/freenet/clients/http/filter/GenericReadFilterCallback.java
2006-12-07 21:24:30 UTC (rev 11290)
@@ -216,13 +216,16 @@
cb.onText(s, type, baseURI);
}
+ static final String PLUGINS_PREFIX = "/plugins/";
+
/**
* Process a form.
* Current strategy:
* - Both POST and GET forms are allowed to /
* Anything that is hazardous should be protected through formPassword.
+ * @throws CommentException If the form element could not be parsed and
the user should be told.
*/
- public String processForm(String method, String action) {
+ public String processForm(String method, String action) throws
CommentException {
if(action == null) return null;
method = method.toUpperCase();
if(!(method.equals("POST") || method.equals("GET")))
@@ -233,6 +236,21 @@
// FIXME what about /queue/ /darknet/ etc?
if(action.equals("/"))
return action;
+ try {
+ URI uri = URIPreEncoder.encodeURI(action);
+ if(uri.getScheme() != null || uri.getHost() != null ||
uri.getPort() != -1 || uri.getUserInfo() != null)
+ throw new CommentException("Invalid form URI
had scheme, user-info, host or port");
+ String path = uri.getPath();
+ if(path.startsWith(PLUGINS_PREFIX)) {
+ String after =
path.substring(PLUGINS_PREFIX.length());
+ if(after.indexOf("/../") > -1)
+ throw new CommentException("Attempt to
escape directory structure");
+ if(after.matches("[A-Za-z0-9\\.]+"))
+ return uri.toASCIIString();
+ }
+ } catch (URISyntaxException e) {
+ throw new CommentException("Could not encode form URI");
+ }
// Otherwise disallow.
return null;
}
Modified: trunk/freenet/src/freenet/clients/http/filter/HTMLFilter.java
===================================================================
--- trunk/freenet/src/freenet/clients/http/filter/HTMLFilter.java
2006-12-07 21:08:20 UTC (rev 11289)
+++ trunk/freenet/src/freenet/clients/http/filter/HTMLFilter.java
2006-12-07 21:24:30 UTC (rev 11290)
@@ -1570,7 +1570,13 @@
Hashtable hn = super.sanitizeHash(h, p, pc);
String method = (String) h.get("method");
String action = (String) h.get("action");
- String finalAction = pc.cb.processForm(method, action);
+ String finalAction;
+ try {
+ finalAction = pc.cb.processForm(method, action);
+ } catch (CommentException e) {
+ pc.writeAfterTag.append("<!--
").append(HTMLEncoder.encode(e.toString())).append(" -->");
+ return null;
+ }
if(finalAction == null) return null;
hn.put("method", method);
hn.put("action", finalAction);
