Am 16.02.2011 20:51, schrieb Darren New:
> clipka wrote:
>>> STOP, that is no bug, that is by design!
>> What? You mean that it strips any "../.." ???
> One would think that at worst the bug would be "it silently gives the
> wrong result instead of reporting an error."
> If the intention is to disallow ".." at the start of the string for
> security purposes, it should give an error rather than point at a
> different file (which would be its own security problem right there). If
> it's not security-related, I'm really curious how this could be
> considered a feature.
From the code it is pretty obvious that the original intention is to
eliminate ".." from paths like "foo/bar/../fnord" by contracting it to
"foo/../fnord" - no security stuff intended there.
Also note that paths having the form "../foo" are passed unharmed.
Post a reply to this message