bug 842742 - don't allow '..' in logfile. r=justdave

git-svn-id: svn://10.0.0.236/trunk@264780 18797224-902f-48f8-a5cc-f745e15eee43
2013-02-20 07:10:48 +00:00
parent cfe160dd7e
commit ee1e5798ec
1 changed files with 4 additions and 0 deletions
--- a/mozilla/webtools/tinderbox/showlog.cgi
+++ b/mozilla/webtools/tinderbox/showlog.cgi
@@ -72,6 +72,10 @@ if (defined($args = $form{log}) or defined($args = $form{exerpt})) {
  $logfile     = shell_escape($form{logfile});
  $buildname   = $form{buildname};
  $buildtime   = $form{buildtime};
+  # bug 842742
+  if ($logfile =~ /\.\./) {
+    die "Illegal logfile parameter $logfile";
+  }
 }
 $fulltext    = $form{fulltext};