Author: wade
Date: 2007-10-17 17:37:31 -0400 (Wed, 17 Oct 2007)
New Revision: 87716
Modified:
branches/mono-1-2-5/mcs/class/System.Web/System.Web/ChangeLog
branches/mono-1-2-5/mcs/class/System.Web/System.Web/StaticFileHandler.cs
Log:
Backport r87715 from trunk
Modified: branches/mono-1-2-5/mcs/class/System.Web/System.Web/ChangeLog
===================================================================
--- branches/mono-1-2-5/mcs/class/System.Web/System.Web/ChangeLog
2007-10-17 21:27:58 UTC (rev 87715)
+++ branches/mono-1-2-5/mcs/class/System.Web/System.Web/ChangeLog
2007-10-17 21:37:31 UTC (rev 87716)
@@ -1,3 +1,17 @@
+2007-10-17 Marek Habersack <[EMAIL PROTECTED]>
+
+ * StaticFileHandler.cs: fixed an bug with Mono running under
+ Windows operating systems which caused XSP to return source of the
+ requested page if the file name used in the request ended in any
+ number of spaces or dots. The problem lies in the way the Win32
+ subsystem treats such file names - it ignores the trailing
+ characters and allows the calling application to open a file on
+ disk even when its name does not contain the trailing characters
+ used in the open request. Such file names may be supported by the
+ underlying filesystem (e.g. NTFS) but they are not supported by
+ the I/O Win32 subsystem. The security issue is reported in
+ CVE security report CVE-2007-5473. Fixes bug #332401
+
2007-07-22 Vladimir Krasnov <[EMAIL PROTECTED]>
* HttpServerUtility.cs: fixed Execute, SetCurrentExePath should be
Modified:
branches/mono-1-2-5/mcs/class/System.Web/System.Web/StaticFileHandler.cs
===================================================================
--- branches/mono-1-2-5/mcs/class/System.Web/System.Web/StaticFileHandler.cs
2007-10-17 21:27:58 UTC (rev 87715)
+++ branches/mono-1-2-5/mcs/class/System.Web/System.Web/StaticFileHandler.cs
2007-10-17 21:37:31 UTC (rev 87716)
@@ -31,18 +31,38 @@
using System;
using System.Globalization;
using System.IO;
+using System.Web.Util;
namespace System.Web
{
class StaticFileHandler : IHttpHandler
{
+ static bool runningWindows = RunningOnWindows ();
+
+ static bool RunningOnWindows ()
+ {
+ int pid = (int)Environment.OSVersion.Platform;
+ return (pid != 4 && pid != 128);
+ }
+
+ static bool ValidFileName (string fileName)
+ {
+ if (!runningWindows)
+ return true;
+
+ if (fileName == null || fileName.Length == 0)
+ return false;
+
+ return (!StrUtils.EndsWith (fileName, " ") &&
!StrUtils.EndsWith (fileName, "."));
+ }
+
public void ProcessRequest (HttpContext context)
{
HttpRequest request = context.Request;
HttpResponse response = context.Response;
string fileName = request.PhysicalPath;
FileInfo fi = new FileInfo (fileName);
- if (!fi.Exists)
+ if (!fi.Exists || !ValidFileName (fileName))
throw new HttpException (404, "File '" +
request.FilePath + "' not found.");
if ((fi.Attributes & FileAttributes.Directory) != 0) {
_______________________________________________
Mono-patches maillist - [email protected]
http://lists.ximian.com/mailman/listinfo/mono-patches
