You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shindig.apache.org by "Bastian Hofmann (JIRA)" <ji...@apache.org> on 2010/07/21 16:24:53 UTC
[jira] Created: (SHINDIG-1393) Relative Message Bundle URLs from
the GadgetXML directory are not accepted anymore
Relative Message Bundle URLs from the GadgetXML directory are not accepted anymore
----------------------------------------------------------------------------------
Key: SHINDIG-1393
URL: https://issues.apache.org/jira/browse/SHINDIG-1393
Project: Shindig
Issue Type: Bug
Components: PHP
Reporter: Bastian Hofmann
In version 1.0 you could add message bundles with a relative path from the gadget xml directory like this:
<Locale messages="local/en_ALL.xml"/>
This is not possible anymore in the current trunk. The following patch takes the implementation out of 1.0 and ports it to the current trunk. Additionally there is a regex check on the relative url, so that it is not possible to request resources outside of the gadget directory.
Index: php/src/gadgets/GadgetFactory.php
===================================================================
200a200,216
> $parsedUri = parse_url($locale['messages']);
> if (empty($parsedUri['host'])) {
> // relative path's in the locale spec uri
> // check against valid chars so that we can make sure that the given
> // relative url is valid and does not try to fetch files outside of
> // gadget scope (e.g. /../../../usr/bin... )
> $pattern = '%^(([a-zA-Z0-9\-_](?<!\.)){1,2}([a-zA-Z0-9\.\-_](?<!\.\.))*/?)+$%';
> if (preg_match($pattern, $locale['messages'])){
> $gadgetUrl = $this->context->getUrl();
> $gadgetUrl = substr($gadgetUrl, 0, strrpos($gadgetUrl, '/') + 1);
> $locale['messages'] = $gadgetUrl . str_replace('..', '', $locale['messages']);
> } else {
> // remove any locales that are not applicable to this context
> unset($gadget->gadgetSpec->locales[$key]);
> continue;
> }
> }
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (SHINDIG-1393) Relative Message Bundle URLs from
the GadgetXML directory are not accepted anymore
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1393?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Paul Lindner resolved SHINDIG-1393.
-----------------------------------
Fix Version/s: 2.0.0-RC1
Resolution: Fixed
patch committed, thanks!
> Relative Message Bundle URLs from the GadgetXML directory are not accepted anymore
> ----------------------------------------------------------------------------------
>
> Key: SHINDIG-1393
> URL: https://issues.apache.org/jira/browse/SHINDIG-1393
> Project: Shindig
> Issue Type: Bug
> Components: PHP
> Reporter: Bastian Hofmann
> Fix For: 2.0.0-RC1
>
>
> In version 1.0 you could add message bundles with a relative path from the gadget xml directory like this:
> <Locale messages="local/en_ALL.xml"/>
> This is not possible anymore in the current trunk. The following patch takes the implementation out of 1.0 and ports it to the current trunk. Additionally there is a regex check on the relative url, so that it is not possible to request resources outside of the gadget directory.
> Index: php/src/gadgets/GadgetFactory.php
> ===================================================================
> 200a200,216
> > $parsedUri = parse_url($locale['messages']);
> > if (empty($parsedUri['host'])) {
> > // relative path's in the locale spec uri
> > // check against valid chars so that we can make sure that the given
> > // relative url is valid and does not try to fetch files outside of
> > // gadget scope (e.g. /../../../usr/bin... )
> > $pattern = '%^(([a-zA-Z0-9\-_](?<!\.)){1,2}([a-zA-Z0-9\.\-_](?<!\.\.))*/?)+$%';
> > if (preg_match($pattern, $locale['messages'])){
> > $gadgetUrl = $this->context->getUrl();
> > $gadgetUrl = substr($gadgetUrl, 0, strrpos($gadgetUrl, '/') + 1);
> > $locale['messages'] = $gadgetUrl . str_replace('..', '', $locale['messages']);
> > } else {
> > // remove any locales that are not applicable to this context
> > unset($gadget->gadgetSpec->locales[$key]);
> > continue;
> > }
> > }
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.