mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-17 09:13:04 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

The "/." and "/.." at the end of URI should be normalized.

Browse Source
This commit is contained in:
Ruslan Ermilov 2019-10-08 21:56:14 +03:00
parent 2ac24f1c88
commit ed42131da6
1 changed files with 32 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
src/http/ngx_http_parse.c
View File

@ -1437,9 +1437,11 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
state = sw_quoted; state = sw_quoted;
break; break;
case '?': case '?':
u--;
r->args_start = p; r->args_start = p;
goto args; goto args;
case '#': case '#':
u--;
goto done; goto done;
case '+': case '+':
r->plus_in_uri = 1; r->plus_in_uri = 1;
@ -1467,7 +1469,8 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
case '\\': case '\\':
#endif #endif
case '/': case '/':
state = sw_slash; case '?':
case '#':
u -= 5; u -= 5;
for ( ;; ) { for ( ;; ) {
if (u < r->uri.data) { if (u < r->uri.data) {
@ -1479,16 +1482,19 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
} }
u--; u--;
} }
if (ch == '?') {
r->args_start = p;
goto args;
}
if (ch == '#') {
goto done;
}
state = sw_slash;
break; break;
case '%': case '%':
quoted_state = state; quoted_state = state;
state = sw_quoted; state = sw_quoted;
break; break;
case '?':
r->args_start = p;
goto args;
case '#':
goto done;
case '+': case '+':
r->plus_in_uri = 1; r->plus_in_uri = 1;
/* fall through */ /* fall through */
@ -1565,6 +1571,26 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
return NGX_HTTP_PARSE_INVALID_REQUEST; return NGX_HTTP_PARSE_INVALID_REQUEST;
} }
if (state == sw_dot) {
u--;
} else if (state == sw_dot_dot) {
u -= 5;
for ( ;; ) {
if (u < r->uri.data) {
return NGX_HTTP_PARSE_INVALID_REQUEST;
}
if (*u == '/') {
u++;
break;
}
u--;
}
}
done: done:
r->uri.len = u - r->uri.data; r->uri.len = u - r->uri.data;