Changeset 3748279 for optimazz/trunk/includes/Modules/Cache/engine.php

Timestamp:

10/15/2026 11:24:25 AM (11 days ago)

Author:

shiponkarmakar

Message:

Release v1.1.1

File:

• optimazz/trunk/includes/Modules/Cache/engine.php (modified) (4 diffs)

optimazz/trunk/includes/Modules/Cache/engine.php

@@ -616 +616 @@
                 $query = isset( $parts[1] ) ? $parts[1] : '';
 
-                // Sanitize path — never allow traversal.
-                $path = str_replace( array( '..', "\0" ), '', $path );
-                $path = '/' . trim( preg_replace( '#[^a-zA-Z0-9/_\-.]#', '-', $path ), '/' );
+                $path = self::sanitize_path( $path );
                 $dir  = self::cache_root() . self::sanitize_segment( $host ) . rtrim( $path, '/' ) . '/';
 
@@ -708 +706 @@
                 $host     = self::url_host( $parts );
                 $path     = isset( $parts['path'] ) ? $parts['path'] : '/';
-                $path     = str_replace( array( '..', "\0" ), '', $path );
-                $path     = '/' . trim( preg_replace( '#[^a-zA-Z0-9/_\-.]#', '-', $path ), '/' );
+                $path     = self::sanitize_path( $path );
                 $host_dir = self::cache_root() . self::sanitize_segment( $host ) . '/';
                 $dir      = self::cache_root() . self::sanitize_segment( $host ) . rtrim( $path, '/' ) . '/';
@@ -803 +800 @@
          */
         public static function site_dir( $host, $path ) {
-                $path = trim( str_replace( array( '..', "\0" ), '', (string) $path ), '/' );
-                $path = preg_replace( '#[^a-zA-Z0-9/_\-.]#', '-', $path );
+                $path = trim( self::sanitize_path( $path ), '/' );
                 return self::cache_root() . self::sanitize_segment( strtolower( (string) $host ) ) . ( '' !== $path ? '/' . $path : '' ) . '/';
         }
@@ -874 +870 @@
          */
         private static function sanitize_segment( $segment ) {
-                return preg_replace( '#[^a-zA-Z0-9_\-.]#', '-', (string) $segment );
+                return preg_replace( '#\.{2,}#', '.', preg_replace( '#[^a-zA-Z0-9_\-.]#', '-', (string) $segment ) );
+        }
+
+        /**
+         * Sanitize a URL path for use as cache folders: unsafe characters (NUL
+         * included) become "-", then any run of dots becomes one, so nothing can
+         * rebuild "..".
+         *
+         * @param string $path URL path.
+         * @return string Path with one leading slash and no trailing slash.
+         */
+        private static function sanitize_path( $path ) {
+                $path = preg_replace( '#\.{2,}#', '.', preg_replace( '#[^a-zA-Z0-9/_\-.]#', '-', (string) $path ) );
+                return '/' . trim( $path, '/' );
         }