Unquote URL escapes in dirplex elements.

diff --git a/lib/req.c b/lib/req.c
index 8ea2fbc..4cde483 100644 (file)
--- a/lib/req.c
+++ b/lib/req.c
@@ -268,3 +268,37 @@ fail:
     errno = EPROTO;
     return(-1);
 }
+
+char *unquoteurl(char *in)
+{
+    struct charbuf buf;
+    char *p;
+    int c;
+    
+    bufinit(buf);
+    p = in;
+    while(*p) {
+       if(*p == '%') {
+           if(!p[1] || !p[2])
+               goto fail;
+           c = 0;
+           if((p[1] >= '0') && (p[1] <= '9'))          c |= (p[1] - '0') << 4;
+           else if((p[1] >= 'a') && (p[1] <= 'f'))     c |= (p[1] - 'a' + 10) << 4;
+           else if((p[1] >= 'A') && (p[1] <= 'F'))     c |= (p[1] - 'A' + 10) << 4;
+           else                                        goto fail;
+           if((p[2] >= '0') && (p[2] <= '9'))          c |= (p[2] - '0');
+           else if((p[2] >= 'a') && (p[2] <= 'f'))     c |= (p[2] - 'a' + 10);
+           else if((p[2] >= 'A') && (p[2] <= 'F'))     c |= (p[2] - 'A' + 10);
+           else                                        goto fail;
+           bufadd(buf, c);
+           p += 3;
+       } else {
+           bufadd(buf, *(p++));
+       }
+    }
+    bufadd(buf, 0);
+    return(buf.b);
+fail:
+    buffree(buf);
+    return(NULL);
+}

diff --git a/lib/req.h b/lib/req.h
index 9d77499..a5e50ba 100644 (file)
--- a/lib/req.h
+++ b/lib/req.h
@@ -22,5 +22,6 @@ int recvreq(int sock, struct hthead **reqp);
 void replrest(struct hthead *head, char *rest);
 int parseheaders(struct hthead *head, FILE *in);
 int writeresp(FILE *out, struct hthead *resp);
+char *unquoteurl(char *in);
 
 #endif

diff --git a/src/dirplex.c b/src/dirplex.c
index 402d654..52313cc 100644 (file)
--- a/src/dirplex.c
+++ b/src/dirplex.c
@@ -494,6 +494,12 @@ static void serve(struct hthead *req, int fd)
        } else {
            *(p2++) = 0;
        }
+       if((tmp = unquoteurl(p)) == NULL) {
+           simpleerror(fd, 400, "Bad Request", "The requested URL contains an invalid escape sequence.");
+           goto fail;
+       }
+       strcpy(p, tmp);
+       free(tmp);
        
        if(!*p) {
            if(p2 == NULL) {