mirror of
https://github.com/nmap/nmap.git
synced 2026-08-30 05:37:05 +00:00
Fix for this TODO item:
o Fix cases of std::string() being used in ways which wrongly parse the data for escape sequences such as \n. For an example, see log message of r6474 in svn. (note that this was a Lua escaping bug, not std::string)
This commit is contained in:
parent
0c14637993
commit
be2ddcfa1c
1 changed files with 28 additions and 1 deletions
29
nse_init.cc
29
nse_init.cc
|
|
@ -704,6 +704,28 @@ int init_scandir(char* dirname, std::vector<std::string>& result, int files_or_d
|
|||
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
// Takes a string and converts \, ', and " characters so that
|
||||
// the string is suitable for embedding in a Lua ' or " string.
|
||||
// Remember to free() when finished
|
||||
|
||||
char *make_lua_escaped_string(char *str) {
|
||||
char *tp, *out;
|
||||
out = tp = (char *) safe_malloc((strlen(str)*2) + 1); // assume every character needs escaping
|
||||
|
||||
while(*str) {
|
||||
if (*str == '\\' || *str == '\'' || *str == '"') *tp++ = '\\';
|
||||
*tp++ = *str++;
|
||||
}
|
||||
|
||||
*tp = '\0';
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/* load an nmap-lua script
|
||||
* create a new closure to store the script
|
||||
* tell the closure where to find the standard
|
||||
|
|
@ -715,6 +737,7 @@ int init_scandir(char* dirname, std::vector<std::string>& result, int files_or_d
|
|||
* */
|
||||
int init_loadfile(lua_State* l, char* filename) {
|
||||
int rule_count;
|
||||
char *escaped_filename;
|
||||
|
||||
/* create a closure for encapsuled execution
|
||||
* give the closure access to the global enviroment
|
||||
|
|
@ -753,14 +776,18 @@ int init_loadfile(lua_State* l, char* filename) {
|
|||
* */
|
||||
lua_getmetatable(l, -1);
|
||||
|
||||
escaped_filename = make_lua_escaped_string(filename);
|
||||
|
||||
std::string buf =
|
||||
(std::string("err = \"Attempted to change the global '\" .. select(2, ...) .. \"' in ")
|
||||
+ std::string(filename)
|
||||
+ std::string(escaped_filename)
|
||||
+ std::string(" - use nmap.registry if you really want to share data between scripts.\"")
|
||||
+ std::string("error(err)"));
|
||||
SCRIPT_ENGINE_LUA_TRY(luaL_loadbuffer(l, buf.c_str(), buf.length(), "Global Access"));
|
||||
lua_setfield(l, -2, "__newindex");
|
||||
|
||||
free(escaped_filename);
|
||||
|
||||
lua_setmetatable(l, -2);
|
||||
|
||||
/* store the initialized test in either
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue