[ php-blog-Bugs-1850031 ] Media Library fails when creating directory ending in "."

Bugs item #1850031, was opened at 2007-12-13 13:14
Message generated for change (Comment added) made by garvinhicking
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1850031&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Administrative functions
Group: None
>Status: Open
>Resolution: None
>Priority: 2
Private: No
Submitted By: Nobody/Anonymous (nobody)
>Assigned to: Nobody/Anonymous (nobody)
Summary: Media Library fails when creating directory ending in "."

Initial Comment:
Version: Serendipity 1.2
OS: CentOS 5

Steps to reproduce problem:
- Go to admin page
- Click "Manage directories"
- Create new directory "Test."
- Try to upload picture to new directory, this fails

Apparently the URL is sanitized, because the upload attempts to use "Test/" instead of "Test./"

Thanks to my mom for finding the bug ;-)

Greetings,
  Ed.

----------------------------------------------------------------------

>Comment By: Garvin Hicking (garvinhicking)
Date: 2007-12-13 14:40

Message:
Logged In: YES 
user_id=473563
Originator: NO

Hi!

Okay, I agree. I didn't want to offend you by closing it. But I am
actually too afraid to change something in the basically secure input
validation because it might inject some directory traversal when using
special characters. I'd rather avoid "\.+/" completely in the directory,
but I leave it up to other developers who might want to make a testcase for
possible intrusion vectors (also with UTF-7 and \0 or other characters that
might match on something.

An input like "../categories./../../" definitely would need to be
avoided.

Regards,
Garvin

----------------------------------------------------------------------

Comment By: Ed Voncken (evoncken)
Date: 2007-12-13 14:24

Message:
Logged In: YES 
user_id=65335
Originator: NO

I don't think this issue should have been closed - it is an extremely
annoying bug, and a "mere mortal" cannot understand or fix the problem.

It is an input validation problem - the system should not accept input
that it cannot handle.

A simple check on "m/\.$/" would suffice to avoid the issue altogether. Is
that an option?

Greetings,
  Ed.

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2007-12-13 14:02

Message:
Logged In: YES 
user_id=473563
Originator: NO

Hi!

Thanks for reporting, however as you already mentioned: This is more a
sanitizing security issues than a bug. We can't really fix this, because
then we might be subject to directory traversal attacks. It shold work when
you use "Test.X", i.e. a dot can never appear next to a directory slash.

Regards,
Garvin

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-12-13 13:15

Message:
Logged In: NO 

Sorry, forgot to log on - I'm evoncken at sourceforge.net

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1850031&group_id=75065

-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace