[ Walt Haas writes: ]
>
> If the address were:
>
> usr/STLIB_SALSA@stlib.state.nm.us
>
> then it would be treated as hostile.
OK, I see how the 1.93 code breaks now. The test on "/$components[0]"
should only be done if $components[0] was null from the split. I had
that coded once and lost sight of why. This should work:
if ( m#/# ) {
local(@components) = split( /\//, $_);
if ($components[0] eq "") {
shift @components;
&main'abort("HOSTILE ADDRESS (path exists to /file) $addr")
if (-e "/$components[0]"); #'
}
else {
&main'abort("HOSTILE ADDRESS (path exists to file) $addr")
if (-e "$components[0]"); #'
}
This way the '/' is prefixed *only* when it existed in the original
address.
--
Dave Wolfe
Follow-Ups:
References:
|
|
