Hacker News Reader

Comment by IshKebab | Hacker News Reader

> NamedFile::open(Path::new("www/").join(file)).ok()

Is this vulnerable to the classic "../../../../../../../etc/passwd"?

I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation.

EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.

Based on a quick read of the source, the conversion from a "<param..>" input to a "PathBuf" type strips leading ".." components automatically.

So would this still work?

  ValidDir/../../../../../../../etc/passwd

Slashes aren't allowed, so wouldn't be able to do any path traversals: https://api.rocket.rs/src/rocket/request/param.rs.html#298

Afaik remember windows will parse additional dots beyond the two first as another level up? Cross-platform secure coding is hard... (Not sure about this code though, just making an observation).

> On Windows, decoded segment contains any of: '\'

And on Japanese and Korean windows? It uses the yen symbol as path separator. Depending on how the path is read or interpreted, filtering the yen may be necessary.

https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).a...

FYI, this is called a path traversal attack.

Reply on news.ycombinator.com