path: fix traversal check on Windows

On Windows the traversal logic only matched the literal "..\", but
Windows accepts "/" as well.

Fix SCPathContainsTraversal() on Windows to check both "..\\" and "../".

Ticket: #8830.
pull/16213/head
Victor Julien 3 months ago committed by Victor Julien
parent 29c98799e8
commit 8305ac3028

@ -268,11 +268,11 @@ const char *SCBasename(const char *path)
bool SCPathContainsTraversal(const char *path) bool SCPathContainsTraversal(const char *path)
{ {
#ifdef OS_WIN32 #ifdef OS_WIN32
const char *pattern = "..\\"; /* Win32 treats '/' and '\\' as equivalent directory separators */
return strstr(path, "../") != NULL || strstr(path, "..\\") != NULL;
#else #else
const char *pattern = "../"; return strstr(path, "../") != NULL;
#endif #endif
return strstr(path, pattern) != NULL;
} }
/** /**

Loading…
Cancel
Save