rapid7 / rex-core

Created by David Maloney via the GitHub Connector
Other
4 stars 23 forks source link

Escape dots in clean_path()'s regexes #4

Closed justinsteven closed 7 years ago

justinsteven commented 7 years ago

clean_path()'s regexes have unescaped dots, causing unintended over-cleaning.

Before patch:

irb(main):003:0> ::Rex::FileUtils::clean_path('a/b/../c')                                                                                                                                                                                                                                   
=> "a/b/c"

This is good

irb(main):004:0> ::Rex::FileUtils::clean_path('a/b/ZZ/c')                                                                                                                                                                                                                                   
=> "a/b/c"

This is bad

Post-patch:

irb(main):002:0> ::Rex::FileUtils::clean_path('a/b/../c')
=> "a/b/c"
irb(main):003:0> ::Rex::FileUtils::clean_path('a/b/ZZ/c')
=> "a/b/ZZ/c"
irb(main):004:0> ::Rex::FileUtils::clean_path('a/b/..\\c')                                                                                                                                                                                                                                  
=> "a/b/c"
irb(main):005:0> ::Rex::FileUtils::clean_path('../a/b/..\\c')                                                                                                                                                                                                                               
=> "a/b/c"
irb(main):006:0> ::Rex::FileUtils::clean_path('..\\a/b/..\\c')                                                                                                                                                                                                                              
=> "a/b/c"
busterb commented 7 years ago

Thanks @justinsteven , those unescaped dots definitely look like an oversight to me.

pbarry-r7 commented 7 years ago

Agreed, escaped dots FTW w.r.t. regex. :+1:

busterb commented 7 years ago

I'm going to suggest we move the examples in the PR description into spec/rex/file_spec.rb

busterb commented 7 years ago

Thanks @pbarry-r7

pbarry-r7 commented 7 years ago

Release Notes

This patch ensures the Rex clean_path() logic doesn't unexpectedly remove valid directory names from the path being "cleaned".

pbarry-r7 commented 7 years ago

Thanks for the fix, @justinsteven!