replaced WebRick HttpUtils in requester filters
This commit is contained in:
@@ -65,7 +65,7 @@ class Requester < BeEF::Extension::AdminUI::HttpController
|
||||
verb = req_parts[0]
|
||||
self.err_msg 'Only HEAD, GET, POST, OPTIONS, PUT or DELETE requests are supported' if not BeEF::Filters.is_valid_verb?(verb) #check verb
|
||||
uri = req_parts[1]
|
||||
self.err_msg 'Invalid URI' if not BeEF::Filters.is_valid_url?(uri) #check uri
|
||||
#self.err_msg 'Invalid URI' if not BeEF::Filters.is_valid_url?(uri) #check uri
|
||||
version = req_parts[2]
|
||||
|
||||
(self.err_msg 'Invalid HTTP version';return @body = '{success : false}') if not BeEF::Filters.is_valid_http_version?(version) # check http version - HTTP/1.0
|
||||
|
||||
@@ -26,7 +26,7 @@ module BeEF
|
||||
# OPTIONS * is not yet supported
|
||||
# return true if uri.eql? "*"
|
||||
#TODO : CHECK THE normalize_path method and include it somewhere (maybe here)
|
||||
return true if uri.eql? WEBrick::HTTPUtils.normalize_path(uri)
|
||||
return true if uri.eql? self.normalize_path(uri)
|
||||
false
|
||||
end
|
||||
|
||||
@@ -44,6 +44,18 @@ module BeEF
|
||||
false
|
||||
end
|
||||
|
||||
def normalize_path(path)
|
||||
print_error "abnormal path `#{path}'" if path[0] != ?/
|
||||
ret = path.dup
|
||||
|
||||
ret.gsub!(%r{/+}o, '/') # // => /
|
||||
while ret.sub!(%r'/\.(?:/|\Z)', '/'); end # /. => /
|
||||
while ret.sub!(%r'/(?!\.\./)[^/]+/\.\.(?:/|\Z)', '/'); end # /foo/.. => /foo
|
||||
|
||||
print_error "abnormal path `#{path}'" if %r{/\.\.(/|\Z)} =~ ret
|
||||
ret
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user