requests: assert that theres no @ in the URLs authority

[pve-http-server.git] / src / PVE / APIServer / AnyEvent.pm

diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index f5653e9be4d18717044055900ae1c57f6225f611..9de623815b2ddfea50a7647e87e51005cc668ff7 100644 (file)
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -293,9 +293,16 @@ sub response {
 
     my $code = $resp->code;
     my $msg = $resp->message || HTTP::Status::status_message($code);
-    ($msg) = $msg =~m/^(.*)$/m;
     my $content = $resp->content;
 
+    # multiline mode only checks \n for $, so explicitly check for any \n or \r afterwards
+    ($msg) = $msg =~ m/^(.*)$/m;
+    if ($msg =~ /[\r\n]/) {
+       $code = 400; # bad request from user
+       $msg = HTTP::Status::status_message($code);
+       $content = '';
+    }
+
     if ($code =~ /^(1\d\d|[23]04)$/) {
        # make sure informational, no content and not modified response send no content
        $content = "";
@@ -695,10 +702,20 @@ sub proxy_request {
     eval {
        my $target;
        my $keep_alive = 1;
+
+       # stringify URI object and verify it starts with a slash
+       $uri = "$uri";
+       if ($uri !~ m@^/@) {
+           $self->error($reqstate, 400, "invalid proxy uri");
+           return;
+       }
+
+       my $may_stream_file;
        if ($host eq 'localhost') {
            $target = "http://$host:85$uri";
            # keep alive for localhost is not worth (connection setup is about 0.2ms)
            $keep_alive = 0;
+           $may_stream_file = 1;
        } elsif (Net::IP::ip_is_ipv6($host)) {
            $target = "https://[$host]:8006$uri";
        } else {
@@ -784,6 +801,10 @@ sub proxy_request {
                        $header->header(Location => $location);
                    }
                    if ($stream) {
+                       if (!$may_stream_file) {
+                           $self->error($reqstate, 403, 'streaming denied');
+                           return;
+                       }
                        sysopen(my $fh, "$stream", O_NONBLOCK | O_RDONLY)
                            or die "open stream path '$stream' for forwarding failed: $!\n";
                        my $resp = HTTP::Response->new($code, $msg, $header, undef);
@@ -1553,6 +1574,11 @@ sub push_request_header {
                        $self->error($reqstate, 506, "http protocol version $maj.$min not supported");
                        return;
                    }
+                   if ($url =~ m|^[^/]*@|) {
+                       # if an '@' comes before the first slash proxy forwarding might consider
+                       # the frist part of the url to be part of an authority...
+                       $self->error($reqstate, 400, "invalid url");
+                   }
 
                    $self->{request_count}++; # only count valid request headers
                    if ($self->{request_count} >= $self->{max_requests}) {