Author: mhabersack
Date: 2007-10-17 17:27:58 -0400 (Wed, 17 Oct 2007)
New Revision: 87715
Modified:
trunk/mcs/class/System.Web/System.Web/ChangeLog
trunk/mcs/class/System.Web/System.Web/StaticFileHandler.cs
Log:
2007-10-17 Marek Habersack <[EMAIL PROTECTED]>
* StaticFileHandler.cs: fixed an bug with Mono running under
Windows operating systems which caused XSP to return source of the
requested page if the file name used in the request ended in any
number of spaces or dots. The problem lies in the way the Win32
subsystem treats such file names - it ignores the trailing
characters and allows the calling application to open a file on
disk even when its name does not contain the trailing characters
used in the open request. Such file names may be supported by the
underlying filesystem (e.g. NTFS) but they are not supported by
the I/O Win32 subsystem. The security issue is reported in
CVE security report CVE-2007-5473. Fixes bug #332401
Modified: trunk/mcs/class/System.Web/System.Web/ChangeLog
===================================================================
--- trunk/mcs/class/System.Web/System.Web/ChangeLog 2007-10-17 21:17:41 UTC
(rev 87714)
+++ trunk/mcs/class/System.Web/System.Web/ChangeLog 2007-10-17 21:27:58 UTC
(rev 87715)
@@ -1,3 +1,17 @@
+2007-10-17 Marek Habersack <[EMAIL PROTECTED]>
+
+ * StaticFileHandler.cs: fixed an bug with Mono running under
+ Windows operating systems which caused XSP to return source of the
+ requested page if the file name used in the request ended in any
+ number of spaces or dots. The problem lies in the way the Win32
+ subsystem treats such file names - it ignores the trailing
+ characters and allows the calling application to open a file on
+ disk even when its name does not contain the trailing characters
+ used in the open request. Such file names may be supported by the
+ underlying filesystem (e.g. NTFS) but they are not supported by
+ the I/O Win32 subsystem. The security issue is reported in
+ CVE security report CVE-2007-5473. Fixes bug #332401
+
2007-10-17 Igor Zelmanovich <[EMAIL PROTECTED]>
* HttpResponse.cs:
Modified: trunk/mcs/class/System.Web/System.Web/StaticFileHandler.cs
===================================================================
--- trunk/mcs/class/System.Web/System.Web/StaticFileHandler.cs 2007-10-17
21:17:41 UTC (rev 87714)
+++ trunk/mcs/class/System.Web/System.Web/StaticFileHandler.cs 2007-10-17
21:27:58 UTC (rev 87715)
@@ -31,18 +31,38 @@
using System;
using System.Globalization;
using System.IO;
+using System.Web.Util;
namespace System.Web
{
class StaticFileHandler : IHttpHandler
{
+ static bool runningWindows = RunningOnWindows ();
+
+ static bool RunningOnWindows ()
+ {
+ int pid = (int)Environment.OSVersion.Platform;
+ return (pid != 4 && pid != 128);
+ }
+
+ static bool ValidFileName (string fileName)
+ {
+ if (!runningWindows)
+ return true;
+
+ if (fileName == null || fileName.Length == 0)
+ return false;
+
+ return (!StrUtils.EndsWith (fileName, " ") &&
!StrUtils.EndsWith (fileName, "."));
+ }
+
public void ProcessRequest (HttpContext context)
{
HttpRequest request = context.Request;
HttpResponse response = context.Response;
string fileName = request.PhysicalPath;
FileInfo fi = new FileInfo (fileName);
- if (!fi.Exists)
+ if (!fi.Exists || !ValidFileName (fileName))
throw new HttpException (404, "File '" +
request.FilePath + "' not found.");
if ((fi.Attributes & FileAttributes.Directory) != 0) {
_______________________________________________
Mono-patches maillist - [email protected]
http://lists.ximian.com/mailman/listinfo/mono-patches
