From 59105a9ad667c6e55f4d0da135db126eae0dd2d4 Mon Sep 17 00:00:00 2001
From: zzz <zzz@mail.i2p>
Date: Wed, 1 Jul 2009 16:50:35 +0000
Subject: [PATCH] * HTTP Proxy: Limit proxy.i2p to /themes/ directory
---
.../java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
index ce63e5359f..f450682cd0 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPClient.java
@@ -811,11 +811,14 @@ public class I2PTunnelHTTPClient extends I2PTunnelClientBase implements Runnable
* but inproxy/gateway ops would be wise to block proxy.i2p to prevent
* exposing the docs/ directory or perhaps other issues through
* uncaught vulnerabilities.
+ * Restrict to the /themes/ directory for now.
*
- * @param targetRequest "proxy.i2p/foo.png HTTP/1.1"
+ * @param targetRequest "proxy.i2p/themes/foo.png HTTP/1.1"
*/
private static void serveLocalFile(OutputStream out, String method, String targetRequest) {
- if (method.equals("GET") || method.equals("HEAD")) {
+ if ((method.equals("GET") || method.equals("HEAD")) &&
+ targetRequest.startsWith("proxy.i2p/themes/") &&
+ !targetRequest.contains("..")) {
int space = targetRequest.indexOf(' ');
String filename = null;
try {
--
GitLab