Copilot commented on code in PR #13708:
URL: https://github.com/apache/trafficserver/pull/13708#discussion_r4063487485
##########
plugins/experimental/access_control/access_control.cc:
##########
@@ -29,6 +29,61 @@
size_t calcMessageDigest(const StringView hf, const char *secret, const char
*message, size_t messageLen, char *buffer, size_t len);
const char *getSecretMap(const StringMap &map, const StringView &key, size_t
&secretSize);
+static String
+decodedDotSegment(StringView seg)
+{
+ String res;
+ res.reserve(seg.size());
+ for (size_t i = 0; i < seg.size();) {
+ if (i + 2 < seg.size() && seg[i] == '%' && seg[i + 1] == '2' && (seg[i +
2] == 'e' || seg[i + 2] == 'E')) {
+ res.push_back('.');
+ i += 3;
Review Comment:
This normalization decodes dot bytes but leaves encoded path separators
untouched. For example, `/reports/%2e%2e%2fhr` becomes `/reports/..%2fhr`,
which passes the `/reports` prefix check even though a downstream component
that decodes `%2f` can interpret it as `/reports/../hr`. Normalize or reject
percent-encoded `/` and `\\` separators before performing the scope comparison,
and add a regression test for encoded traversal forms.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
