[interchange-cvs] interchange - kwalsh modified lib/Vend/Interpolate.pm

[interchange-cvs at icdevgroup.org]

User:      kwalsh
Date:      2007-10-11 01:37:16 GMT
Modified:  lib/Vend Interpolate.pm
Log:
    * Fixed something that looked like a security bug.  It seemed to me
      that a filename of "tmp/../../../../something" would get past the
      checks, so changed the code to make use of Vend::File::allowed_file()
      instead.

Revision  Changes    Path
2.286     +6 -4      interchange/lib/Vend/Interpolate.pm


rev 2.286, prev_rev 2.285
Index: Interpolate.pm
===================================================================
RCS file: /var/cvs/interchange/lib/Vend/Interpolate.pm,v
retrieving revision 2.285
retrieving revision 2.286
diff -u -r2.285 -r2.286
--- Interpolate.pm	17 Sep 2007 05:37:31 -0000	2.285
+++ Interpolate.pm	11 Oct 2007 01:37:16 -0000	2.286
@@ -1,6 +1,6 @@
 # Vend::Interpolate - Interpret Interchange tags
 # 
-# $Id: Interpolate.pm,v 2.285 2007/09/17 05:37:31 kwalsh Exp $
+# $Id: Interpolate.pm,v 2.286 2007/10/11 01:37:16 kwalsh Exp $
 #
 # Copyright (C) 2002-2007 Interchange Development Group
 # Copyright (C) 1996-2002 Red Hat, Inc.
@@ -28,7 +28,7 @@
 require Exporter;
 @ISA = qw(Exporter);
 
-$VERSION = substr(q$Revision: 2.285 $, 10);
+$VERSION = substr(q$Revision: 2.286 $, 10);
 
 @EXPORT = qw (
 
@@ -2279,10 +2279,12 @@
 		my $file = $opt->{outfile};
 		$file =~ s/^\s+//;
 		$file =~ s/\s+$//;
-		if($file =~ m{^([A-Za-z]:)?[\\/.]}) {
-			logError("attempt to write absolute file $file");
+
+		unless (Vend::File::allowed_file($file)) {
+			Vend::File::log_file_violation($file, 'value-extended');
 			return '';
 		}
+
 		if($opt->{ascii}) {
 			my $replace = $^O =~ /win32/i ? "\r\n" : "\n";
 			if($CGI::file{$var} !~ /\n/) {