ngx_path_separator()
diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c index 11e62e6..4aa1be8 100644 --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c
@@ -1337,12 +1337,7 @@ goto unsafe; } - if (p[0] == '.' && len == 3 && p[1] == '.' && (p[2] == '/' -#if (NGX_WIN32) - || p[2] == '\\' -#endif - )) - { + if (p[0] == '.' && len == 3 && p[1] == '.' && (ngx_path_separator(p[2]))) { goto unsafe; } @@ -1367,30 +1362,22 @@ continue; } - if ((ch == '/' -#if (NGX_WIN32) - || ch == '\\' -#endif - ) && len > 2) - { + if (ngx_path_separator(ch) && len > 2) { + /* detect "/../" */ - if (p[0] == '.' && p[1] == '.' && p[2] == '/') { + if (p[0] == '.' && p[1] == '.' && ngx_path_separator(p[2])) { goto unsafe; } #if (NGX_WIN32) - if (p[2] == '\\') { - goto unsafe; - } - if (len > 3) { /* detect "/.../" */ if (p[0] == '.' && p[1] == '.' && p[2] == '.' - && (p[3] == '/' || p[3] == '\\')) + && ngx_path_separator(p[3])) { goto unsafe; }
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 31ab640..d06c6dd 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c
@@ -1587,15 +1587,9 @@ continue; } - if (ch == '/' || ch == '\0') { + if (ngx_path_separator(ch) || ch == '\0') { return -1; } - -#if (NGX_WIN32) - if (ch == '\\') { - return -1; - } -#endif } if (dot) {
diff --git a/src/os/unix/ngx_files.h b/src/os/unix/ngx_files.h index 63d080b..7d83b04 100644 --- a/src/os/unix/ngx_files.h +++ b/src/os/unix/ngx_files.h
@@ -160,6 +160,8 @@ #define ngx_realpath_n "realpath()" #define ngx_getcwd(buf, size) (getcwd(buf, size) != NULL) #define ngx_getcwd_n "getcwd()" +#define ngx_path_separator(c) ((c) == '/') + #define NGX_MAX_PATH PATH_MAX #define NGX_DIR_MASK_LEN 0
diff --git a/src/os/win32/ngx_files.h b/src/os/win32/ngx_files.h index f3561d9..1e2c630 100644 --- a/src/os/win32/ngx_files.h +++ b/src/os/win32/ngx_files.h
@@ -154,6 +154,8 @@ #define ngx_realpath_n "" #define ngx_getcwd(buf, size) GetCurrentDirectory(size, buf) #define ngx_getcwd_n "GetCurrentDirectory()" +#define ngx_path_separator(c) ((c) == '/' || (c) == '\\') + #define NGX_MAX_PATH MAX_PATH