Skip to content

Instantly share code, notes, and snippets.

@ucotta
Last active November 9, 2016 03:25
Show Gist options
  • Save ucotta/3c43a19290cd6450ff59a4fed6a4a105 to your computer and use it in GitHub Desktop.
Save ucotta/3c43a19290cd6450ff59a4fed6a4a105 to your computer and use it in GitHub Desktop.
contaisTraversalCharacters is a extension for String to check when a path may contains an traversal path include attack for Swift 3.0
/*
Avoid usage of files with this characters.
Examples with positive response:
/var/www/templates/../../../etc/passwd
/var/www/templates/%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd
/var/www/templates%252e%252e%252f%252e%252e%252f%252e%252e%252fetc/passwd
/var/www/templates/..%c0%af..%c0%af..%c0%afetc/passwd
With this you cannot do things like this:
/var/www/templates/.htdocs (because /. is not allowed)
Please, if you see any error or missing character, please let me know it!!.
*/
extension String {
var containsTraversalCharacters: Bool {
get {
return traversalCharacters.count > 0
}
}
var traversalCharacters: [String] {
get {
let dangerCharacters = ["%2e", "%2f", "%5c", "%252e", "%252f", "%255c", "%c0%af", "%c1%9c", ":", ">", "<", "./", ".\\", "..", "\\\\", "//", "/.", "\\.", "|"]
return dangerCharacters.filter { contains($0) }.flatMap { $0 }
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment