fix(server): fixed possible recursive includes in preprocessing

This commit is contained in:
antifallobst 2023-08-25 00:02:13 +02:00
parent 5c152593e2
commit 76180aaa5a
Signed by: antifallobst
GPG Key ID: 2B4F402172791BAF
2 changed files with 18 additions and 6 deletions

View File

@ -16,8 +16,10 @@ impl Sites {
std::env::set_current_dir(path)?; std::env::set_current_dir(path)?;
let mut home_file = std::fs::File::open("home.html")?; let mut home_file = std::fs::File::open("home.html")?;
let mut visited_inodes = Vec::new();
Ok(Self { Ok(Self {
home: parser::generate_site(&mut home_file)? home: parser::generate_site(&mut home_file, &mut visited_inodes)?
}) })
} }

View File

@ -1,9 +1,17 @@
use std::io::{Read, read_to_string}; use std::{io::Read, os::unix::fs::MetadataExt};
use anyhow::{Error, Result}; use anyhow::{Error, Result};
use log::{error, info}; use log::info;
pub fn generate_site(base: &mut std::fs::File) -> Result<String> { pub fn generate_site(base: &mut std::fs::File, visited_inodes: &mut Vec<u64>) -> Result<String> {
let include_regex = regex::Regex::new("\\s+@@@include ((?:[^\\/]*\\/)*)(.*)@@@")?; let inode = base.metadata()?.ino();
if visited_inodes.contains(&inode) {
return Err(Error::msg("Recursive file inclusion detected!"));
} else {
visited_inodes.push(inode);
}
let include_regex = regex::Regex::new("@@@include ((?:[^\\/]*\\/)*)(.*)@@@")?;
let mut content = String::new(); let mut content = String::new();
base.read_to_string(&mut content)?; base.read_to_string(&mut content)?;
@ -17,11 +25,13 @@ pub fn generate_site(base: &mut std::fs::File) -> Result<String> {
let mut file = std::fs::File::open(parts.get(1).expect("This should never happen due to the regex check."))?; let mut file = std::fs::File::open(parts.get(1).expect("This should never happen due to the regex check."))?;
lines.push(generate_site(&mut file)?); lines.push(generate_site(&mut file, visited_inodes)?);
} else { } else {
lines.push(line.to_owned()); lines.push(line.to_owned());
} }
} }
let _ = visited_inodes.pop();
Ok(lines.join("\n")) Ok(lines.join("\n"))
} }