3 ms·

I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I open

I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.

SpaceManiac 9y ago
Based on a quick read of the source, the conversion from a "<param..>" input to a "PathBuf" type strips leading ".." components automatically.
- sqeaky 9y ago
  So would this still work? ValidDir/../../../../../../../etc/passwd
anonova 9y ago
Slashes aren't allowed, so wouldn't be able to do any path traversals: https://api.rocket.rs/src/rocket/request/param.rs.html#298 https://api.rocket.rs/src/rocket/request/param.rs.html#298
- e12e 9y ago
  Afaik remember windows will parse additional dots beyond the two first as another level up? Cross-platform secure coding is hard... (Not sure about this code though, just making an observation).
- DiThi 9y ago
  > On Windows, decoded segment contains any of: '\' And on Japanese and Korean windows? It uses the yen symbol as path separator. Depending on how the path is read or interpreted, filtering the yen may be necessary. https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).a...
  - deleted 9y ago
    [deleted]