From b7d169bafee3c89b667ae57fc4a2394d21f812bd Mon Sep 17 00:00:00 2001 From: Louis Nyffenegger Date: Wed, 6 Nov 2013 12:52:54 +1100 Subject: [PATCH] Update Application.java Just a quick fix since I was reading that. Prevent someone malicious from doing: echo "GET /images/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00 HTTP/1.0\r\n" | netcat 127.0.0.1 9000 --- samples-and-tests/pdf/app/controllers/Application.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/samples-and-tests/pdf/app/controllers/Application.java b/samples-and-tests/pdf/app/controllers/Application.java index 5aa7a15..b0d2d05 100644 --- a/samples-and-tests/pdf/app/controllers/Application.java +++ b/samples-and-tests/pdf/app/controllers/Application.java @@ -50,7 +50,8 @@ public class Application extends Controller { * @throws MalformedURLException in case of error */ public static void image(String id) throws MalformedURLException, IOException { - File file = new File("/" + Play.frameworkPath + "/documentation/images/" + id + ".png"); + String safeId = new File(id).getName(); + File file = new File("/" + Play.frameworkPath + "/documentation/images/" + safeId + ".png"); if (file.exists()) { Logger.debug("Serving image at '%s'", file.getAbsolutePath()); @@ -198,4 +199,4 @@ private static String toHTML(String textile) { // Extracts only the body of this HTML page return html.substring(html.indexOf("") + 6, html.lastIndexOf("")); } -} \ No newline at end of file +}