Open
Conversation
add hv_normalize_path function to hbase.h support http legal relative path request optimize http server path file cache map key fix false positives '/..file' normal path bug
ithewei
reviewed
Apr 16, 2025
| std::string path = req->Path(); | ||
| const char* req_path = path.c_str(); | ||
| // path safe check | ||
| if (req_path[0] != '/' || strstr(req_path, "/..") || strstr(req_path, "\\..")) { |
Owner
There was a problem hiding this comment.
这里删除了默认的path safe check，会造成能够访问任意上级目录文件
Contributor
Author
There was a problem hiding this comment.
hv_normalize_path 函数的处理不会允许访问不合法的上级目录
其中包括下面这段代码片段
while (--pos > 0) {
if (path[pos - 1] == '/') break;
}
if (pos < 1) return 0;
此处对相对父目录的处理是不会允许超出path / 根目录以上的目录层级，而且规范化处理后的path也是不存在/.. \..此类字符串存在的。
There was a problem hiding this comment.
Pull request overview
该 PR 旨在通过引入统一的路径规范化逻辑，修复 HTTP 静态文件服务在请求路径校验、相对路径处理与文件缓存 key 选择上的缺陷，从而降低路径变体导致的缓存膨胀风险，并修复对“/..file”这类合法路径的误判。
Changes:
- 新增
hv_normalize_path（导出到hbase.h，实现在hbase.c）用于路径规范化（分隔符、./..处理等）。 - 在
HttpHandler::defaultStaticHandler中对req->Path()做规范化，并以规范化后的路径继续参与后续静态文件处理流程。 - 调整静态目录判断相关局部变量声明（
const bool is_dir）。
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| http/server/HttpHandler.cpp | 静态文件处理前对请求 path 做规范化，避免非法/变体路径影响缓存与访问控制。 |
| base/hbase.h | 对外导出新增的路径规范化函数声明。 |
| base/hbase.c | 增加 hv_normalize_path 的具体实现。 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+544
to
+548
| int hv_normalize_path(char *path) { | ||
| if (*path != '/') return 0; | ||
| int pos = 1; | ||
| #ifdef OS_WIN | ||
| int sum = 0; |
Comment on lines
+586
to
+592
| default: | ||
| #ifdef OS_WIN | ||
| // windows is not case sensitive | ||
| path[pos++] = (char)tolower(path[i]); | ||
| #else | ||
| path[pos++] = path[i]; | ||
| #endif |
| return 0; | ||
| } | ||
|
|
||
| int hv_normalize_path(char *path) { |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Owner
|
@copilot open a new pull request to apply changes based on the comments in this thread |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
添加 hv_normalize_path 函数到 hbase.h
实用的文件路径规范化修剪处理函数，解决路径相关缺陷的关键实现。
支持 http 合法相对路径请求
优化 http 服务器相对路径文件缓存映射键
因为内部文件缓存map的key是文件路径，而未经规范化处理的路径格式存在对相同的文件形成无数种字符变化，易造成原本个位数的真实有效文件被外网恶意请求分配出无数个文件缓存造成内存影响，同时也避免了Windows相比Linux的路径兼容性严格程度不同导致的末尾反斜杠不应该访问成功的请求却能够open成功。
修复误报“/..file”正常文件路径 bug
某些文件确实前面几个点符号造成被误判为相对父路径从而终止了请求。