cerc-io/solidity
11
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent information about file existence outside the allowed paths to leak by mimicing boost::filesystem::weakly_canonical.

Browse Source
This commit is contained in:
Daniel Kirchner
2018-04-11 18:52:22 +02:00
parent f39f36f2c7
commit c15cb6cc7a
4 changed files with 33 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
solc/CommandLineInterface.cpp
+7 -7
View File
@@ -700,13 +700,7 @@ bool CommandLineInterface::processInput()
try
{
auto path = boost::filesystem::path(_path);
if (!boost::filesystem::exists(path))
return ReadCallback::Result{false, "File not found."};
auto canonicalPath = boost::filesystem::canonical(path);
if (!boost::filesystem::is_regular_file(canonicalPath))
return ReadCallback::Result{false, "Not a valid file."};
auto canonicalPath = weaklyCanonicalFilesystemPath(path);
bool isAllowed = false;
for (auto const& allowedDir: m_allowedDirectories)
{
@@ -723,6 +717,12 @@ bool CommandLineInterface::processInput()
if (!isAllowed)
return ReadCallback::Result{false, "File outside of allowed directories."};
if (!boost::filesystem::exists(canonicalPath))
return ReadCallback::Result{false, "File not found."};
if (!boost::filesystem::is_regular_file(canonicalPath))
return ReadCallback::Result{false, "Not a valid file."};
auto contents = dev::readFileAsString(canonicalPath.string());
m_sourceCodes[path.string()] = contents;
return ReadCallback::Result{true, contents};