bp/FileHandler: check the path before opening a file

This avoids getting ENAMETOOLONG or ENOTDIR which would result in
status 500.

(On Ceph, I have observed EINVAL responses from MDS instead of ENOTDIR
for opening a path ending with a slash.  That's a Ceph MDS bug, I
guess, but it hopefully becomes unreachable with this check.)

debian/changelog

@@ -5,6 +5,7 @@ cm4all-beng-proxy (18.0.90) unstable; urgency=low
   * was: fail if the Multi-WAS socket buffer is full
   * bp: fix several use-after-free bugs on translation responses
   * bp: map ENAMETOOLONG to "414 Request-URI Too Long"
+  * bp: check the path before opening a file
 
  --   
 

src/bp/FileHandler.cxx

@@ -34,6 +34,70 @@
 
 using std::string_view_literals::operator""sv;
 
+inline bool
+Request::CheckFilePath(const char *path, bool relative) noexcept
+{
+	assert(path != nullptr);
+
+	const std::size_t path_length = strlen(path);
+
+	if (path_length >= PATH_MAX) [[unlikely]] {
+		DispatchError(HttpStatus::REQUEST_URI_TOO_LONG);
+		return false;
+	}
+
+	if (relative) {
+		if (path_length == 0 || *path == '/') [[unlikely]] {
+			DispatchError(HttpStatus::NOT_FOUND);
+			return false;
+		}
+	} else {
+		if (path_length < 2 || *path != '/') [[unlikely]] {
+			DispatchError(HttpStatus::NOT_FOUND);
+			return false;
+		}
+	}
+
+	if (path[path_length - 1] == '/') [[unlikely]] {
+		DispatchError(HttpStatus::NOT_FOUND);
+		return false;
+	}
+
+	return true;
+}
+
+inline bool
+Request::CheckDirectoryPath(const char *path) noexcept
+{
+	assert(path != nullptr);
+
+	const std::size_t path_length = strlen(path);
+
+	if (path_length >= PATH_MAX) [[unlikely]] {
+		DispatchError(HttpStatus::REQUEST_URI_TOO_LONG);
+		return false;
+	}
+
+	if (path_length == 0 || *path != '/') {
+		DispatchError(HttpStatus::NOT_FOUND);
+		return false;
+	}
+
+	return true;
+}
+
+bool
+Request::CheckFileAddress(const FileAddress &address) noexcept
+{
+	if (address.beneath != nullptr && !CheckDirectoryPath(address.beneath))
+		return false;
+
+	if (address.base != nullptr && !CheckDirectoryPath(address.base))
+		return false;
+
+	return CheckFilePath(address.path, address.base != nullptr);
+}
+
 inline void
 Request::Handler::File::Close(UringGlue &uring) noexcept
 {
@@ -345,6 +409,9 @@ Request::OnOpenStatError(int error) noexcept
 void
 Request::HandleFileAddress(const FileAddress &address) noexcept
 {
+	if (!CheckFileAddress(address))
+		return;
+
 	handler.file.address = &address;
 
 	assert(address.path != nullptr);

src/bp/Request.hxx

@@ -568,6 +568,23 @@ private:
 
 	void HandleTokenAuth(UniquePoolPtr<TranslateResponse> response) noexcept;
 
+	/**
+	 * Do formal checks on a #FileAddress and send an error
+	 * response if the address is not acceptable.
+	 *
+	 * @return true if the address is acceptable, false if an
+	 * error response has been submitted (this #Request instance
+	 * may be destroyed)
+	 */
+	[[nodiscard]]
+	bool CheckFileAddress(const FileAddress &address) noexcept;
+
+	[[nodiscard]]
+	bool CheckFilePath(const char *path, bool relative) noexcept;
+
+	[[nodiscard]]
+	bool CheckDirectoryPath(const char *path) noexcept;
+
 	bool EvaluateFileRequest(FileDescriptor fd, const struct statx &st,
 				 struct file_request &file_request) noexcept;