corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1354308 - Entries API must support patches containing '..', r=froydnj

Browse Source
This commit is contained in:
Andrea Marchesini
2017-04-26 15:13:43 +02:00
parent a8ade68c7b
commit 456182cef9
3 changed files with 46 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
dom/filesystem/FileSystemSecurity.cpp
View File

@@ -89,9 +89,17 @@ FileSystemSecurity::ContentProcessHasAccessTo(ContentParentId aId,
MOZ_ASSERT(NS_IsMainThread());
AssertIsInMainProcess();
if (FindInReadable(NS_LITERAL_STRING(".."), aPath)) {
#if defined(XP_WIN)
if (StringBeginsWith(aPath, NS_LITERAL_STRING("..\\")) ||
FindInReadable(NS_LITERAL_STRING("\\..\\"), aPath)) {
return false;
}
#elif defined(XP_UNIX)
if (StringBeginsWith(aPath, NS_LITERAL_STRING("../")) ||
FindInReadable(NS_LITERAL_STRING("/../"), aPath)) {
return false;
}
#endif
nsTArray<nsString>* paths;
if (!mPaths.Get(aId, &paths)) {