cerc-io/solidity
16
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent information about file existence outside the allowed paths to leak by mimicing boost::filesystem::weakly_canonical.

Browse Source
This commit is contained in:
Daniel Kirchner 2018-04-05 14:25:14 +02:00
parent f39f36f2c7
commit c15cb6cc7a
4 changed files with 33 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Changelog.md
View File

@ -20,6 +20,7 @@ Bugfixes:
* Code Generator: Bugfix in modifier lookup in libraries.
* Code Generator: Implement packed encoding of external function types.
* Code Generator: Treat empty base constructor argument list as not provided.
* Commandline interface: Fix error messages for imported files that do not exist.
* Commandline interface: Support ``--evm-version constantinople`` properly.
* DocString Parser: Fix error message for empty descriptions.
* Standard JSON: Support ``constantinople`` as ``evmVersion`` properly.

20
libdevcore/CommonIO.cpp
View File

@ -167,3 +167,23 @@ int dev::readStandardInputChar()
DisableConsoleBuffering disableConsoleBuffering;
return cin.get();
}
boost::filesystem::path dev::weaklyCanonicalFilesystemPath(boost::filesystem::path const &_path)
{
if (boost::filesystem::exists(_path))
return boost::filesystem::canonical(_path);
else
{
boost::filesystem::path head(_path);
boost::filesystem::path tail;
for (auto it = --_path.end(); !head.empty(); --it)
{
if (boost::filesystem::exists(head))
break;
tail = (*it) / tail;
head.remove_filename();
}
head = boost::filesystem::canonical(head);
return head / tail;
}
}

5
libdevcore/CommonIO.h
View File

@ -25,6 +25,7 @@
#include <sstream>
#include <string>
#include <boost/filesystem.hpp>
#include "Common.h"
namespace dev
@ -57,4 +58,8 @@ std::string toString(_T const& _t)
return o.str();
}
/// Partial implementation of boost::filesystem::weakly_canonical (available in boost>=1.60).
/// Should be replaced by the boost implementation as soon as support for boost<1.60 can be dropped.
boost::filesystem::path weaklyCanonicalFilesystemPath(boost::filesystem::path const &_path);
}

14
solc/CommandLineInterface.cpp
View File

@ -700,13 +700,7 @@ bool CommandLineInterface::processInput()
try
{
auto path = boost::filesystem::path(_path);
if (!boost::filesystem::exists(path))
return ReadCallback::Result{false, "File not found."};
auto canonicalPath = boost::filesystem::canonical(path);
if (!boost::filesystem::is_regular_file(canonicalPath))
return ReadCallback::Result{false, "Not a valid file."};
auto canonicalPath = weaklyCanonicalFilesystemPath(path);
bool isAllowed = false;
for (auto const& allowedDir: m_allowedDirectories)
{
@ -723,6 +717,12 @@ bool CommandLineInterface::processInput()
if (!isAllowed)
return ReadCallback::Result{false, "File outside of allowed directories."};
if (!boost::filesystem::exists(canonicalPath))
return ReadCallback::Result{false, "File not found."};
if (!boost::filesystem::is_regular_file(canonicalPath))
return ReadCallback::Result{false, "Not a valid file."};
auto contents = dev::readFileAsString(canonicalPath.string());
m_sourceCodes[path.string()] = contents;
return ReadCallback::Result{true, contents};