SFTP Paths

1. Modify the SFTP function RecvOpen() to use the same path cleanup
   function, GetAndCleanPath(), that all the other SFTP functions use.
2. Add a check to GetAndCleanPath() to make sure the default path is
   still a part of the cleaned path.

Author: ejohnstown

src/wolfsftp.c

@@ -1709,13 +1709,25 @@ static int GetAndCleanPath(const char* defaultPath,
         const byte* data, word32 sz, char* s, word32 sSz)
 {
     char r[WOLFSSH_MAX_FILENAME];
+    int result = WS_SUCCESS;
 
     if (sz >= sizeof r)
-        return WS_BUFFER_E;
-    WMEMCPY(r, data, sz);
-    r[sz] = '\0';
+        result = WS_BUFFER_E;
+
+    if (result == WS_SUCCESS) {
+        WMEMCPY(r, data, sz);
+        r[sz] = '\0';
+        result = wolfSSH_RealPath(defaultPath, r, s, sSz);
+    }
+
+    if (result == WS_SUCCESS && defaultPath != NULL) {
+        if (WSTRNCMP(s, defaultPath, WSTRLEN(defaultPath)) != 0) {
+            WLOG(WS_LOG_SFTP, "Path not contained in default path: %s", s);
+            result = WS_INVALID_PATH_E;
+        }
+    }
 
-    return wolfSSH_RealPath(defaultPath, r, s, sSz);
+    return result;
 }
 
 
@@ -2001,7 +2013,7 @@ int wolfSSH_SFTP_RecvOpen(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
 {
     WS_SFTP_FILEATRB atr;
     WFD    fd;
-    word32 sz, dirSz;
+    word32 sz;
     char   dir[WOLFSSH_MAX_FILENAME];
     word32 reason;
     word32 idx = 0;
@@ -2043,9 +2055,8 @@ int wolfSSH_SFTP_RecvOpen(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         return WS_BUFFER_E;
     }
 
-    dirSz = sizeof(dir);
-    if (wolfSSH_GetPath(ssh->sftpDefaultPath, data + idx, sz, dir, &dirSz)
-            != WS_SUCCESS) {
+    if (GetAndCleanPath(ssh->sftpDefaultPath,
+                data + idx, sz, dir, sizeof(dir)) != WS_SUCCESS) {
         WLOG(WS_LOG_SFTP, "Creating path for file to open failed");
         return WS_FATAL_ERROR;
     }
@@ -2202,7 +2213,7 @@ int wolfSSH_SFTP_RecvOpen(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
 {
 /*    WS_SFTP_FILEATRB atr;*/
     HANDLE fileHandle;
-    word32 sz, dirSz;
+    word32 sz;
     char   dir[WOLFSSH_MAX_FILENAME];
     word32 reason;
     word32 idx = 0;
@@ -2239,8 +2250,7 @@ int wolfSSH_SFTP_RecvOpen(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         return WS_BUFFER_E;
     }
 
-    dirSz = sizeof(dir);
-    if (wolfSSH_GetPath(ssh->sftpDefaultPath, data + idx, sz, dir, &dirSz)
+    if (GetAndCleanPath(ssh->sftpDefaultPath, data + idx, sz, dir, sizeof(dir))
             != WS_SUCCESS) {
         WLOG(WS_LOG_SFTP, "Creating path for file to open failed");
         return WS_FATAL_ERROR;