Summary Files Commits Branches @commit @diff @stats
diff options
context:
space:
mode:
Commitfcde19e3fb1e7b10d4af5742bebb8109c7d911c4 (patch)
Author
 Haelwenn (lanodan) Monnier <contact@hacktivis.me>
2022-03-13 00:43:35 +0100
Committer
 Haelwenn (lanodan) Monnier <contact@hacktivis.me>
2022-03-13 00:48:09 +0100
Filesc01828d532829d144bba504b6484d882640b503b
goodwolf-fcde19e3fb1e7b10d4af5742bebb8109c7d911c4.tar
goodwolf-fcde19e3fb1e7b10d4af5742bebb8109c7d911c4.tar.gz
goodwolf-fcde19e3fb1e7b10d4af5742bebb8109c7d911c4.zip
Parentcb6872cc9790ee2cd04f54ee762c23f5e48d9f4b (diff)
uri: Remove access() check
Otherwise it was returning `NULL` and sending out the path of non-readable files over HTTP (unencrypted) could be unintended. Better to fail in a local path than be sorry.
2 files changed, 3 insertions, 5 deletions
-rw-r--r--uri.c6
-rw-r--r--uri_test.c2
diff --git a/uri.c b/uri.c
index 6d3755a..c026c28 100644
--- a/uri.c
+++ b/uri.c
@@ -26,11 +26,7 @@ badwolf_ensure_uri_scheme(const gchar *text, gboolean try_file)
if(path != NULL)
{
- /* flawfinder: ignore. only used as presence check, no way to pass file descriptor */
- if(access(path, R_OK) == 0)
- {
- f = g_strdup_printf("file://%s", path);
- }
+ f = g_strdup_printf("file://%s", path);
free(path);
diff --git a/uri_test.c b/uri_test.c
index 28bdde9..47fda73 100644
--- a/uri_test.c
+++ b/uri_test.c
@@ -29,6 +29,8 @@ badwolf_ensure_uri_scheme_test(void)
{fallback, "", TRUE},
{"http:///dev/null", "/dev/null", FALSE},
{"file:///dev/null", "/dev/null", TRUE},
+ {"http:///root", "/root", FALSE},
+ {"file:///root", "/root", TRUE},
{"http:///usr/../dev/null", "/usr/../dev/null", FALSE},
{"file:///dev/null", "/usr/../dev/null", TRUE},
{"http://example.org", "example.org", FALSE},