Clean path from containing backslashes in the webserver

[sledgehammer999]

This will prevent the webserver from serving files outside of the webui folder.

Closes #18618

[sledgehammer999]

After path is cleaned the following check should work properly and deny access outside webui root folder

qBittorrent/src/webui/webapplication.cpp

Lines 154 to 156 in 927732f

	const QStringList pathItems {request().path.split(u'/', Qt::SkipEmptyParts)};
	if (pathItems.contains(u".") || pathItems.contains(u".."))
	throw InternalServerErrorHTTPError();

[dgw]

Was about to say, QDir::cleanPath() would have resolved . and .. in the path before the web UI code checked for those.

[sledgehammer999]

Was about to say, QDir::cleanPath() would have resolved . and .. in the path before the web UI code checked for those.

👍
That's why I redid my patch.

[DrunkenSeafarer]

Tested with 5e48d8a
It seems to fix the issue, the server now returns HTTP/1.1 500 Internal Server Error.

>curl -i "http://127.0.0.1:8080/..\..\..\..\..\windows\win.ini"
HTTP/1.1 500 Internal Server Error
connection: keep-alive
content-length: 21
content-security-policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; object-src 'none'; form-action 'self'; frame-ancestors 'self';
content-type: text/plain; charset=UTF-8
date: Mon, 27 Feb 2023 02:04:22 GMT
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Internal Server Error

Against a Linux qbit, I am getting HTTP/1.1 404 Not Found.

Still, the error code being 500 is a bit weird, it suggests some error is not getting handled properly.

[dgw]

Still, the error code being 500 is a bit weird, it suggests some error is not getting handled properly.

The InternalServerErrorHTTPError here matches 500, to me:

qBittorrent/src/webui/webapplication.cpp

Lines 155 to 156 in 927732f

	if (pathItems.contains(u".") || pathItems.contains(u".."))
	throw InternalServerErrorHTTPError();

Still raises the question of where the 404 comes from, then.

[DrunkenSeafarer]

Against a Linux qbit, I am getting HTTP/1.1 404 Not Found.

Still raises the question of where the 404 comes from, then.

Ah, nvm, I need the --path-as-is option for curl, e.g.:
$ curl -ik "https://192.168.xx.yy:zzz/../../../../config_ssl/server.crt" --path-as-is

I was getting the 404 because it was looking inside the public folder directly...

[glassez]

Leftover?

[Chocobo1]

I would use another overload: https://doc.qt.io/qt-6/qstring.html#replace-3
The last time I checked its source, it was simpler (and therefore faster I presume).

[sledgehammer999]

Closed in favor of #18626