amass/ZLMediaKit
1
0
Fork 0
mirror of https://github.com/ZLMediaKit/ZLMediaKit.git synced 2024-11-25 20:27:34 +08:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

提高http文件服务器安全性

Browse Source
This commit is contained in:
xia-chu 2023-08-26 19:43:11 +08:00
parent f36ccee3de
commit 06a6d26491
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/Http/HttpFileManager.cpp
View File

@ -524,7 +524,7 @@ static void accessFile(Session &sender, const Parser &parser, const MediaInfo &m
});
}
static string getFilePath(const Parser &parser,const MediaInfo &media_info, Session &sender){
static string getFilePath(const Parser &parser,const MediaInfo &media_info, Session &sender) {
GET_CONFIG(bool, enableVhost, General::kEnableVhost);
GET_CONFIG(string, rootPath, Http::kRootPath);
GET_CONFIG_FUNC(StrCaseMap, virtualPathMap, Http::kVirtualPath, [](const string &str) {
@ -549,6 +549,13 @@ static string getFilePath(const Parser &parser,const MediaInfo &media_info, Sess
}
}
auto ret = File::absolutePath(enableVhost ? media_info.vhost + url : url, path);
auto http_root = File::absolutePath(enableVhost ? media_info.vhost + "/" : "/", path);
if (!start_with(ret, http_root)) {
// 访问的http文件不得在http根目录之外
throw std::runtime_error("Attempting to access files outside of the http root directory");
}
// 替换url，防止返回的目录索引网页被注入非法内容
const_cast<Parser&>(parser).setUrl("/" + ret.substr(http_root.size()));
NoticeCenter::Instance().emitEvent(Broadcast::kBroadcastHttpBeforeAccess, parser, ret, static_cast<SockInfo &>(sender));
return ret;
}