[vlma-devel] commit: Improved RrdGraphServlet. (Adrien Grand )

[git version control]

vlma | branch: master | Adrien Grand <jpountz at videolan.org> | Sun Nov  9 14:31:42 2008 +0100| [7f5d964eaee8a8ff8fa9a67b5afd6635ced502fd] | committer: Adrien Grand 

Improved RrdGraphServlet.

> http://git.videolan.org/gitweb.cgi/vlma.git/?a=commit;h=7f5d964eaee8a8ff8fa9a67b5afd6635ced502fd
---

 .../videolan/vlma/web/servlet/RrdGraphServlet.java |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/vlma-webapp/src/main/java/org/videolan/vlma/web/servlet/RrdGraphServlet.java b/vlma-webapp/src/main/java/org/videolan/vlma/web/servlet/RrdGraphServlet.java
index e7ec1c4..7967e9e 100644
--- a/vlma-webapp/src/main/java/org/videolan/vlma/web/servlet/RrdGraphServlet.java
+++ b/vlma-webapp/src/main/java/org/videolan/vlma/web/servlet/RrdGraphServlet.java
@@ -34,7 +34,6 @@ import org.springframework.util.Assert;
 import org.springframework.web.context.WebApplicationContext;
 import org.springframework.web.context.support.WebApplicationContextUtils;
 import org.videolan.vlma.Data;
-import org.videolan.vlma.exception.InvalidServerNameException;
 
 /**
  * A servlet which aims at providing a secure and robust way to access to the
@@ -56,10 +55,6 @@ public class RrdGraphServlet extends HttpServlet {
         Data data = (Data) webApplicationContext.getBean("dataImporter");
 
         String serverName = request.getParameter("server");
-        if (serverName.contains(File.separator)) {
-            throw new InvalidServerNameException("Server name musn't contain '"
-                    + File.separator + "'.");
-        }
 
         String what = request.getParameter("what");
         Assert.isTrue("vlc".equals(what) || "cpu_load".equals(what)
@@ -68,6 +63,10 @@ public class RrdGraphServlet extends HttpServlet {
         String basePath = data.getString("vlma.data");
         File rrdDir = new File(basePath, "rrd");
         File file = new File(rrdDir, serverName + "-" + what + ".png");
+        // Ensure it does not try to open files outside ${vlma.data}/rrd
+        if(!file.getParentFile().equals(rrdDir)) {
+            throw new IllegalArgumentException("Cannot find the specified graph");
+        }
 
         response.setContentType("image/png");
         ServletOutputStream out = response.getOutputStream();