diff --git a/build/src/mongoose.c b/build/src/mongoose.c index 0505f16d9236c6410ca84cf076f41ed482592adc..c9d845c7508dbb8a407975fa8cada76c7671b44a 100644 --- a/build/src/mongoose.c +++ b/build/src/mongoose.c @@ -503,29 +503,6 @@ static int get_request_len(const char *buf, int buf_len) { return 0; } -// Protect against directory disclosure attack by removing '..', -// excessive '/' and '\' characters -static void remove_double_dots_and_double_slashes(char *s) { - char *p = s; - - while (*s != '\0') { - *p++ = *s++; - if (s[-1] == '/' || s[-1] == '\\') { - // Skip all following slashes, backslashes and double-dots - while (s[0] != '\0') { - if (s[0] == '/' || s[0] == '\\') { - s++; - } else if (s[0] == '.' && s[1] == '.') { - s += 2; - } else { - break; - } - } - } - } - *p = '\0'; -} - static const struct { const char *extension; size_t ext_len; diff --git a/build/src/string.c b/build/src/string.c index 226d8f3631fc855915b6c9642d2f2583b010f529..ea2491e5a49ad9171aced27a4360f20d83969025 100644 --- a/build/src/string.c +++ b/build/src/string.c @@ -243,3 +243,26 @@ static int match_prefix(const char *pattern, int pattern_len, const char *str) { return j; } +// Protect against directory disclosure attack by removing '..', +// excessive '/' and '\' characters +static void remove_double_dots_and_double_slashes(char *s) { + char *p = s; + + while (*s != '\0') { + *p++ = *s++; + if (s[-1] == '/' || s[-1] == '\\') { + // Skip all following slashes, backslashes and double-dots + while (s[0] != '\0') { + if (s[0] == '/' || s[0] == '\\') { + s++; + } else if (s[0] == '.' && s[1] == '.') { + s += 2; + } else { + break; + } + } + } + } + *p = '\0'; +} + diff --git a/mongoose.c b/mongoose.c index 269c1e9e504aa703c43439316ef195beac263a4d..6649d35c58f2c2d47ab670511b73c3a76869ea6e 100644 --- a/mongoose.c +++ b/mongoose.c @@ -726,6 +726,29 @@ static int match_prefix(const char *pattern, int pattern_len, const char *str) { return j; } +// Protect against directory disclosure attack by removing '..', +// excessive '/' and '\' characters +static void remove_double_dots_and_double_slashes(char *s) { + char *p = s; + + while (*s != '\0') { + *p++ = *s++; + if (s[-1] == '/' || s[-1] == '\\') { + // Skip all following slashes, backslashes and double-dots + while (s[0] != '\0') { + if (s[0] == '/' || s[0] == '\\') { + s++; + } else if (s[0] == '.' && s[1] == '.') { + s += 2; + } else { + break; + } + } + } + } + *p = '\0'; +} + static const char *month_names[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", @@ -2673,29 +2696,6 @@ static int get_request_len(const char *buf, int buf_len) { return 0; } -// Protect against directory disclosure attack by removing '..', -// excessive '/' and '\' characters -static void remove_double_dots_and_double_slashes(char *s) { - char *p = s; - - while (*s != '\0') { - *p++ = *s++; - if (s[-1] == '/' || s[-1] == '\\') { - // Skip all following slashes, backslashes and double-dots - while (s[0] != '\0') { - if (s[0] == '/' || s[0] == '\\') { - s++; - } else if (s[0] == '.' && s[1] == '.') { - s += 2; - } else { - break; - } - } - } - } - *p = '\0'; -} - static const struct { const char *extension; size_t ext_len;