[9front] [PATCH] rc-httpd: do not escape FS_ROOT for dir-index and serve-static

[igor@9lab.org]

The below diff fixes the rc-httpd issue exposed on 4chan[1] whereby one could
escape FS_ROOT via clever URL manipulations when used with dir-index/serve-static
http-handlers.

The solution makes use of cleanname(1) and checks if the computed
path is still prefixed with FS_ROOT.

I am sure there are other solutions, consider this as one possible suggestion...

[1] https://inbox.vuxu.org/9front/EC93BCF8DB4A22F2A1E6CF0D3FB0C16A@5ess.inri.net/


diff 2367a2aeaec8432e6b059135e49c2fa86e415ae5 uncommitted
--- a/rc/bin/rc-httpd/handlers/dir-index
+++ b/rc/bin/rc-httpd/handlers/dir-index
@@ -2,6 +2,10 @@
 PATH_INFO=`{echo $PATH_INFO | urlencode -d}
 full_path=$"FS_ROOT^$"PATH_INFO
 full_path=$"full_path
+if(! ~ `{cleanname -d$FS_ROOT $full_path} `{cleanname $FS_ROOT}^*){
+	error 503
+	exit
+}
 if(! test -d $full_path){
 	error 404
 	exit
@@ -14,8 +18,7 @@
 if(~ $"NOINDEXFILE ^ $"NOINDEX ''){
 	ifile=index.htm*
 	if(! ~ $ifile(1) *'*'){
-		PATH_INFO=$ifile(1)
-		FS_ROOT=''
+		PATH_INFO=$PATH_INFO^$ifile(1)
 		exec serve-static
 	}
 }
--- a/rc/bin/rc-httpd/handlers/serve-static
+++ b/rc/bin/rc-httpd/handlers/serve-static
@@ -1,6 +1,10 @@
 #!/bin/rc
 full_path=`{echo $"FS_ROOT^$"PATH_INFO | urlencode -d}
 full_path=$"full_path
+if(! ~ `{cleanname -d$FS_ROOT $full_path} `{cleanname $FS_ROOT}^*){
+	error 503
+	exit
+}
 if(~ $full_path */)
 	error 503
 if(test -d $full_path){