Added path check

This commit is contained in:
Uwe Seimet 2021-09-15 10:57:12 +02:00
parent 8172c9fdfe
commit 9a8c35db6b
4 changed files with 12 additions and 6 deletions

View File

@ -29,7 +29,7 @@ Note: The command and type arguments are case insensitive. Only the first letter
.SH OPTIONS .SH OPTIONS
.TP .TP
.BR \-a\fI " "\fIFILENAME:FILESIZE .BR \-a\fI " "\fIFILENAME:FILESIZE
Create a disk image file with the specified name and size in bytes. Create an image file in the default image folder with the specified name and size in bytes.
.TP .TP
.BR \-g\fI " "\fILOG_LEVEL .BR \-g\fI " "\fILOG_LEVEL
Set the rascsi log level (trace, debug, info, warn, err, critical, off). Set the rascsi log level (trace, debug, info, warn, err, critical, off).

View File

@ -22,8 +22,8 @@ DESCRIPTION
OPTIONS OPTIONS
-a FILENAME:FILESIZE -a FILENAME:FILESIZE
Create a disk image file with the specified name and size in Create an image file in the default image folder with the speci
bytes. fied name and size in bytes.
-g LOG_LEVEL -g LOG_LEVEL
Set the rascsi log level (trace, debug, info, warn, err, criti Set the rascsi log level (trace, debug, info, warn, err, criti

View File

@ -712,10 +712,12 @@ bool CreateImage(int fd, const PbCommand& command)
} }
string filename = command.params().Get(0); string filename = command.params().Get(0);
if (filename[0] != '/') { if (filename.find('/') != string::npos) {
filename = default_image_folder + "/" + filename; return ReturnStatus(fd, false, "The image filename '" + filename + "' must not contain a path");
} }
filename = default_image_folder + "/" + filename;
off_t len; off_t len;
try { try {
len = stoul(command.params().Get(1)); len = stoul(command.params().Get(1));

View File

@ -61,8 +61,12 @@ enum PbOperation {
RESERVE = 14; RESERVE = 14;
// Create an image file. The image file must not yet exist. // Create an image file. The image file must not yet exist.
// PbCommand.params(0) contains the filename, PbCommand.params(1) contains the file size in bytes. // PbCommand.params(0) contains the filename, PbCommand.params(1) contains the file size in bytes.
// If the filename is relative (does not start with a slash) the file is created in the default image folder. // The filename always refers to the default image folder and must not contain a slash.
CREATE_IMAGE = 15; CREATE_IMAGE = 15;
// Delete an image file
// PbCommand.params(0) contains the filename.
// The filename always refers to the default image folder and must not contain a slash.
DELETE_IMAGE = 16;
} }
// The properties supported by a device, helping clients to offer a good user experience // The properties supported by a device, helping clients to offer a good user experience