[Gnash-commit] gnash ChangeLog gui/Player.cpp server/impl.cpp

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  07/12/28 19:35:14

Modified files:
        .              : ChangeLog 
        gui            : Player.cpp 
        server         : impl.cpp 

Log message:
        SECURITY: don't add the base url to the local sandbox paths, as it may
        be forged by publisher (-P base=xxx).

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.5266&r2=1.5267
http://cvs.savannah.gnu.org/viewcvs/gnash/gui/Player.cpp?cvsroot=gnash&r1=1.74&r2=1.75
http://cvs.savannah.gnu.org/viewcvs/gnash/server/impl.cpp?cvsroot=gnash&r1=1.132&r2=1.133

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.5266
retrieving revision 1.5267
diff -u -b -r1.5266 -r1.5267
--- ChangeLog   27 Dec 2007 19:29:03 -0000      1.5266
+++ ChangeLog   28 Dec 2007 19:35:13 -0000      1.5267
@@ -1,3 +1,15 @@
+2007-12-28 Sandro Santilli <address@hidden>
+
+       * gui/Player.cpp, server/impl.cpp: don't add the "base url"
+         of the movie to the local sandboxes list, since it may be
+         set by HTML tags attribute (think base=/).
+         Instead, add the basedir of the actual filename loaded.
+         This might be /tmp for konqueror plugin, or none for npapi
+         plugin (loads from stdin). Using the basedir helps testing
+         where you have required data in the same dir of the main
+         movie. -u, -U, -P base=x do not modify the local sandbox
+         paths anymore.
+
 2007-12-27 Benjamin Wolsey <address@hidden>
 
         * libamf/sol.cpp: use correct delete[].

Index: gui/Player.cpp
===================================================================
RCS file: /sources/gnash/gnash/gui/Player.cpp,v
retrieving revision 1.74
retrieving revision 1.75
diff -u -b -r1.74 -r1.75
--- gui/Player.cpp      16 Dec 2007 09:17:22 -0000      1.74
+++ gui/Player.cpp      28 Dec 2007 19:35:14 -0000      1.75
@@ -216,8 +216,27 @@
        }
        else
        {
+               URL url(_infile);
+
+               // If the movie is loaded from the filesystem we need
+               // to grant access to it
+               if ( url.protocol() == "file" )
+               {
+                       RcInitFile& rcfile = RcInitFile::getDefaultInstance();
+
+                       const std::string& path = url.path();
+
+#if 1 // add the *directory* the movie was loaded from to the local sandbox 
path
+                       size_t lastSlash = path.find_last_of('/');
+                       rcfile.addLocalSandboxPath(path.substr(0, lastSlash+1));
+#else // add the *file* to be loaded to the local sandbox path
+                       rcfile.addLocalSandboxPath(path);
+#endif
+                       log_debug(_("%s appended to local sandboxes"), 
url.path().c_str());
+               }
+
                // _url should be always set at this point...
-               md = gnash::create_library_movie(URL(_infile), _url.c_str(), 
false);
+               md = gnash::create_library_movie(url, _url.c_str(), false);
        }
     } catch (const GnashException& er) {
        fprintf(stderr, "%s\n", er.what());

Index: server/impl.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/impl.cpp,v
retrieving revision 1.132
retrieving revision 1.133
diff -u -b -r1.132 -r1.133
--- server/impl.cpp     18 Dec 2007 12:34:45 -0000      1.132
+++ server/impl.cpp     28 Dec 2007 19:35:14 -0000      1.133
@@ -17,7 +17,7 @@
 // Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 //
 
-/* $Id: impl.cpp,v 1.132 2007/12/18 12:34:45 udog Exp $ */
+/* $Id: impl.cpp,v 1.133 2007/12/28 19:35:14 strk Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -98,6 +98,17 @@
   globals::baseurl.reset(new URL(url));
   log_debug(_("Base url set to: %s"), globals::baseurl->str().c_str());
 
+#ifdef 
ALLOW_ACCESS_TO_ARBITRARY_LOCATIONS_OF_MY_FILESYSTEM_FROM_FLASH_MOVIE_PUBLISHERS
+// 
+// Adding the "base url" as a local sandbox used to be kind of fine until we
+// added support for the 'base' attribute of EMBED and OBJECT html tags.
+// That attribute determines how to resolve relative urls, so affects the
+// call to set_base_url. 
+// This means that the HTML author might specify '/' as the base url and obtain
+// access to any filesystem location if we do append the 'virtual base url'
+// to the local sandbox paths.
+//
+#if 0
   // If base url is a local file, we push the local file's directory
   // to the list of local sandboxes
   if ( url.protocol() == "file" )
@@ -110,6 +121,8 @@
     rcfile.addLocalSandboxPath(path.substr(0, lastSlash+1));
     log_debug(_("Dir %s appended to local sandboxes"), url.path().c_str());
   }
+#endif
+#endif
 }
 
 const URL&