src/tm_utils.c
bool is_path_ok(const char *str, team_data_t *td)
{
  /* we must URL decode in case there are %NN code in the string */
  if (str == NULL) {
    return true;
  }

  int out_len = 0;
  CURL *curl = curl_easy_init();
  char *decoded = curl_easy_unescape(curl, str, 0, &out_len);
  curl_easy_cleanup(curl);

  if (decoded == NULL) {
    return false;
  }

  if (strstr(decoded, "..") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, "//") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, ".git") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, ".ssh") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, ".svn") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, ".vscode") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, ".htaccess") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, "etc") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, "php") != NULL ) {
    curl_free(decoded);
    return false;
  }

  if (strstr(decoded, "<script>") != NULL ) {
    curl_free(decoded);
    return false;
  }


  mtevL(mtev_debug, "Path allowed: %s\n", decoded);
  curl_free(decoded);
  return true;
}
/* looks at `str` and determines if it's a garbage path.  Things like:
 *
 * /../../../../../../etc/passwd
 *
 * and other obvious hack attempts
 */
looks at `str` and determines if it's a garbage path.

and other obvious hack attempts
looks at ` str ` and determines if it ' s a garbage path . and other obvious hack attempts
bool is_path_ok(const char *str, team_data_t *td)
{
  if (str == NULL) {
    return true;
  }
  int out_len = 0;
  CURL *curl = curl_easy_init();
  char *decoded = curl_easy_unescape(curl, str, 0, &out_len);
  curl_easy_cleanup(curl);
  if (decoded == NULL) {
    return false;
  }
  if (strstr(decoded, "..") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, "//") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, ".git") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, ".ssh") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, ".svn") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, ".vscode") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, ".htaccess") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, "etc") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, "php") != NULL ) {
    curl_free(decoded);
    return false;
  }
  if (strstr(decoded, "<script>") != NULL ) {
    curl_free(decoded);
    return false;
  }
  mtevL(mtev_debug, "Path allowed: %s\n", decoded);
  curl_free(decoded);
  return true;
}
bool is_path_ok ( const char * str , team_data_t * td ) { if ( str == NULL ) { return true ; } int out_len = 0 ; CURL * curl = curl_easy_init ( ) ; char * decoded = curl_easy_unescape ( curl , str , 0 , & out_len ) ; curl_easy_cleanup ( curl ) ; if ( decoded == NULL ) { return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } if ( strstr ( decoded , " " ) != NULL ) { curl_free ( decoded ) ; return false ; } mtevL ( mtev_debug , " \n " , decoded ) ; curl_free ( decoded ) ; return true ; }
looks at `str` and determines if it's a garbage path.
looks at ` str ` and determines if it ' s a garbage path .
/* we must URL decode in case there are %NN code in the string */