server/beego
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix issue 4946 (#4954)

Browse Source 
* Update tree.go

fix issue 4946 CVE-2022-31259
This commit is contained in:
runner361 2022-05-23 18:15:13 +08:00 committed by GitHub
parent daf779ffca
commit 64cf44d725
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -8,6 +8,7 @@
- [Support lifecycle callback](https://github.com/beego/beego/pull/4918) - [Support lifecycle callback](https://github.com/beego/beego/pull/4918)
- [Append column comments to create table sentence when using postgres](https://github.com/beego/beego/pull/4940) - [Append column comments to create table sentence when using postgres](https://github.com/beego/beego/pull/4940)
- [logs: multiFileLogWriter uses incorrect formatter](https://github.com/beego/beego/pull/4943) - [logs: multiFileLogWriter uses incorrect formatter](https://github.com/beego/beego/pull/4943)
- [fix issue 4946 CVE-2022-31259](https://github.com/beego/beego/pull/4954)
# v2.0.2 # v2.0.2
See v2.0.2-beta.1 See v2.0.2-beta.1

4
server/web/tree.go
View File

@ -341,9 +341,9 @@ func (t *Tree) match(treePattern string, pattern string, wildcardValues []string
if runObject == nil && len(t.fixrouters) > 0 { if runObject == nil && len(t.fixrouters) > 0 {
// Filter the .json .xml .html extension // Filter the .json .xml .html extension
for _, str := range allowSuffixExt { for _, str := range allowSuffixExt {
if strings.HasSuffix(seg, str) && strings.HasSuffix(treePattern, seg) { // pattern == "" avoid cases: /aaa.html/aaa.html could access /aaa/:bbb
if strings.HasSuffix(seg, str) && pattern == "" {
for _, subTree := range t.fixrouters { for _, subTree := range t.fixrouters {
// strings.HasSuffix(treePattern, seg) avoid cases: /aaa.html/bbb could access /aaa/bbb
if subTree.prefix == seg[:len(seg)-len(str)] { if subTree.prefix == seg[:len(seg)-len(str)] {
runObject = subTree.match(treePattern, pattern, wildcardValues, ctx) runObject = subTree.match(treePattern, pattern, wildcardValues, ctx)
if runObject != nil { if runObject != nil {

3
server/web/tree_test.go
View File

@ -122,6 +122,9 @@ func init() {
notMatchTestInfo(abcSuffix, "/abc/suffix.html/a"), notMatchTestInfo(abcSuffix, "/abc/suffix.html/a"),
matchTestInfo(abcSuffix, "/abc/suffix/a", nil), matchTestInfo(abcSuffix, "/abc/suffix/a", nil),
notMatchTestInfo(abcSuffix, "/abc.j/suffix/a"), notMatchTestInfo(abcSuffix, "/abc.j/suffix/a"),
// test for fix of issue 4946
notMatchTestInfo("/suffix/:name", "/suffix.html/suffix.html"),
matchTestInfo("/suffix/:id/name", "/suffix/1234/name.html", map[string]string{":id": "1234", ":ext": "html"}),
} }
} }