bugzilla.gnome.org/attachment.cgi?id=258810 — a/rsvg-base.c 2013-05-11 05:19:07.000000000 -0400 +++ b/rsvg-base.c 2013-11-02 13:01:46.446835464 -0400 @@ -2151,9 +2151,8 @@
GError **error) { RsvgHandlePrivate *priv = handle->priv;
GFile *base;
char *path, *dir;
char *scheme = NULL, *cpath = NULL, *cdir = NULL;
+ GFile *base = NULL, *urifile = NULL; + char *scheme = NULL;
g_assert (handle->priv->load_policy == RSVG_LOAD_POLICY_STRICT);
@@ -2183,47 +2182,35 @@
if (!g_str_equal (scheme, "file")) goto deny;
+ Ensure that uri is under the file's base directory
base = g_file_get_parent (priv->base_gfile); if (base == NULL) goto deny;
dir = g_file_get_path (base);
g_object_unref (base);
-
FIXME portability
cdir = canonicalize_file_name (dir);
g_free (dir);
if (cdir == NULL)
+ urifile = g_file_new_for_uri (uri); + if (urifile == NULL)
goto deny;
path = g_filename_from_uri (uri, NULL, NULL);
if (path == NULL)
goto deny;
-
/* FIXME portability */
cpath = canonicalize_file_name (path);
g_free (path);
-
if (cpath == NULL)
+ if (!g_file_has_prefix (urifile, base))
goto deny;
/* Now check that @cpath is below @cdir */
if (!g_str_has_prefix (cpath, cdir) ||
cpath[strlen (cdir)] != G_DIR_SEPARATOR)
goto deny;
+ g_object_unref (urifile); + g_object_unref (base);
/* Allow load! */ allow: g_free (scheme);
free (cpath);
free (cdir); return TRUE;
deny: g_free (scheme);
free (cpath);
free (cdir);
+ + if (urifile) + g_object_unref (urifile); + + if (base) + g_object_unref (base);
g_set_error (error, G_IO_ERROR, G_IO_ERROR_PERMISSION_DENIED, "File may not link to URI \"%s\"", uri);