| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2010 Google Inc. All rights reserved. | 2 * Copyright (C) 2010 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 99 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 110 } | 110 } |
| 111 return result; | 111 return result; |
| 112 } | 112 } |
| 113 | 113 |
| 114 bool DOMFilePath::isValidPath(const String& path) | 114 bool DOMFilePath::isValidPath(const String& path) |
| 115 { | 115 { |
| 116 if (path.isEmpty() || path == DOMFilePath::root) | 116 if (path.isEmpty() || path == DOMFilePath::root) |
| 117 return true; | 117 return true; |
| 118 | 118 |
| 119 // Embedded NULs are not allowed. | 119 // Embedded NULs are not allowed. |
| 120 if (path.find(static_cast<UChar>(0)) != WTF::notFound) | 120 if (path.find(static_cast<UChar>(0)) != WTF::kNotFound) |
| 121 return false; | 121 return false; |
| 122 | 122 |
| 123 // While not [yet] restricted by the spec, '\\' complicates implementation f
or Chromium. | 123 // While not [yet] restricted by the spec, '\\' complicates implementation f
or Chromium. |
| 124 if (path.find('\\') != WTF::notFound) | 124 if (path.find('\\') != WTF::kNotFound) |
| 125 return false; | 125 return false; |
| 126 | 126 |
| 127 // This method is only called on fully-evaluated absolute paths. Any sign of
".." or "." is likely an attempt to break out of the sandbox. | 127 // This method is only called on fully-evaluated absolute paths. Any sign of
".." or "." is likely an attempt to break out of the sandbox. |
| 128 Vector<String> components; | 128 Vector<String> components; |
| 129 path.split(DOMFilePath::separator, components); | 129 path.split(DOMFilePath::separator, components); |
| 130 for (size_t i = 0; i < components.size(); ++i) { | 130 for (size_t i = 0; i < components.size(); ++i) { |
| 131 if (components[i] == ".") | 131 if (components[i] == ".") |
| 132 return false; | 132 return false; |
| 133 if (components[i] == "..") | 133 if (components[i] == "..") |
| 134 return false; | 134 return false; |
| 135 } | 135 } |
| 136 return true; | 136 return true; |
| 137 } | 137 } |
| 138 | 138 |
| 139 bool DOMFilePath::isValidName(const String& name) | 139 bool DOMFilePath::isValidName(const String& name) |
| 140 { | 140 { |
| 141 if (name.isEmpty()) | 141 if (name.isEmpty()) |
| 142 return true; | 142 return true; |
| 143 // '/' is not allowed in name. | 143 // '/' is not allowed in name. |
| 144 if (name.contains('/')) | 144 if (name.contains('/')) |
| 145 return false; | 145 return false; |
| 146 return isValidPath(name); | 146 return isValidPath(name); |
| 147 } | 147 } |
| 148 | 148 |
| 149 } // namespace WebCore | 149 } // namespace WebCore |
| OLD | NEW |