Backport safe_relative_path/1 from OTP 19.3

Author: jhlywa

src/elli_static.erl

@@ -88,7 +88,7 @@ maybe_file(Req, Prefix, Dir) ->
 
     %% santize the path ensuring the request doesn't access any parent
     %% directories ... and reattach the slash if deemed safe
-    SafePath = case filename:safe_relative_path(RawPath) of
+    SafePath = case safe_relative_path(RawPath) of
                    unsafe ->
                        throw(?NOT_FOUND);
                    %% return type quirk work around
@@ -110,3 +110,77 @@ maybe_file(Req, Prefix, Dir) ->
         _ ->
             nothing
     end.
+
+%% @doc Backport of `filename:safe_relative_path/1' from 19.3. This code was
+%% lifted from:
+%% https://github.com/erlang/otp/blob/master/lib/stdlib/src/filename.erl#L811
+-spec safe_relative_path(file:name_all()) -> unsafe | file:name_all().
+safe_relative_path(Path) ->
+    %% prefer the OTP version of `safe_relative_path/1' if it exists
+    case lists:member({safe_relative_path, 1},
+                      filename:module_info(exports)) of
+        true ->
+            %% to suppress xref warnings on 19.2 and lower
+            Mod = filename,
+            Mod:safe_relative_path(Path);
+        false ->
+            case filename:pathtype(Path) of
+                relative ->
+                    Cs0 = filename:split(Path),
+                    safe_relative_path_1(Cs0, []);
+                _ ->
+                    unsafe
+            end
+    end.
+
+safe_relative_path_1(["."|T], Acc) ->
+    safe_relative_path_1(T, Acc);
+safe_relative_path_1([<<".">>|T], Acc) ->
+    safe_relative_path_1(T, Acc);
+safe_relative_path_1([".."|T], Acc) ->
+    climb(T, Acc);
+safe_relative_path_1([<<"..">>|T], Acc) ->
+    climb(T, Acc);
+safe_relative_path_1([H|T], Acc) ->
+    safe_relative_path_1(T, [H|Acc]);
+safe_relative_path_1([], []) ->
+    [];
+safe_relative_path_1([], Acc) ->
+    filename:join(lists:reverse(Acc)).
+
+climb(_, []) ->
+    unsafe;
+climb(T, [_|Acc]) ->
+    safe_relative_path_1(T, Acc).
+
+
+-ifdef(TEST).
+-include_lib("eunit/include/eunit.hrl").
+
+safe_relative_path_test() ->
+    %% binary args
+    ?assertMatch([], safe_relative_path(<<>>)),
+    ?assertMatch(unsafe, safe_relative_path(<<"/">>)),
+    ?assertMatch(unsafe, safe_relative_path(<<"/root">>)),
+    ?assertMatch(unsafe, safe_relative_path(<<"..">>)),
+    ?assertMatch(unsafe, safe_relative_path(<<"dir/../../dir">>)),
+    ?assertMatch(<<"dir">>, safe_relative_path(<<"dir">>)),
+    ?assertMatch(<<"dir">>, safe_relative_path(<<"dir/../dir">>)),
+    ?assertMatch(<<"dir/sub">>, safe_relative_path(<<"dir/sub/../sub">>)),
+    ?assertMatch(<<"dir/sub">>, safe_relative_path(<<"dir/./sub">>)),
+    ?assertMatch(<<"dir/sub">>, safe_relative_path(<<"dir/././../dir/././sub">>)),
+
+    %% string args
+    %% (these are here for completeness since `filename:safe_relative_path'
+    %% supports string arguments
+    ?assertMatch([], safe_relative_path("")),
+    ?assertMatch(unsafe, safe_relative_path("/")),
+    ?assertMatch(unsafe, safe_relative_path("/root")),
+    ?assertMatch(unsafe, safe_relative_path("..")),
+    ?assertMatch(unsafe, safe_relative_path("dir/../../dir")),
+    ?assertMatch("dir", safe_relative_path("dir")),
+    ?assertMatch("dir", safe_relative_path("dir/../dir")),
+    ?assertMatch("dir/sub", safe_relative_path("dir/sub/../sub")),
+    ?assertMatch("dir/sub", safe_relative_path("dir/./sub")),
+    ?assertMatch("dir/sub", safe_relative_path("dir/././../dir/././sub")).
+-endif.