bugzilla.gnome.org/attachment.cgi?id=258810 — a/rsvg-base.c 2013-05-11 05:19:07.000000000 -0400 +++ b/rsvg-base.c 2013-11-02 13:01:46.446835464 -0400 @@ -2151,9 +2151,8 @@

                         GError **error)
{
    RsvgHandlePrivate *priv = handle->priv;

+ GFile *base = NULL, *urifile = NULL; + char *scheme = NULL;

g_assert (handle->priv->load_policy == RSVG_LOAD_POLICY_STRICT);

@@ -2183,47 +2182,35 @@

if (!g_str_equal (scheme, "file"))
    goto deny;

+ Ensure that uri is under the file's base directory

base = g_file_get_parent (priv->base_gfile);
if (base == NULL)
    goto deny;

-

+ urifile = g_file_new_for_uri (uri); + if (urifile == NULL)

goto deny;

-

-

+ if (!g_file_has_prefix (urifile, base))

goto deny;

+ g_object_unref (urifile); + g_object_unref (base);

   /* Allow load! */

allow:
   g_free (scheme);
deny:
   g_free (scheme);

+ + if (urifile) + g_object_unref (urifile); + + if (base) + g_object_unref (base);

g_set_error (error, G_IO_ERROR, G_IO_ERROR_PERMISSION_DENIED,
             "File may not link to URI \"%s\"", uri);