Only allow absolute paths

ulib/fs/path.c

@@ -38,6 +38,19 @@ void path_parse(const char *in, char *mp, char *path) {
   } else {
     path[j] = 0;
   }
+  
+  if (path[0] != '/') {
+    mp[0] = 0;
+    path[0] = 0;
+    return;
+  }
+
+  if (string_strstr(path, "/../") || string_strstr(path, "/./")
+   || string_strcmp(path, "..") == 0 || string_strcmp(path, ".") == 0) {
+    mp[0] = 0;
+    path[0] = 0;
+    return;
+  }
 }
 
 const char *path_basename(const char *path) {

ulib/string/string.c

@@ -282,3 +282,34 @@ void * string_memmove(void* dest, const void* src, unsigned int n)
     }
     return dest;
 }
+
+char *string_strstr(const char *str, const char *substring)
+{
+    const char *a;
+    const char *b;
+
+    b = substring;
+
+    if (*b == 0) {
+        return (char *) str;
+    }
+
+    for ( ; *str != 0; str += 1) {
+        if (*str != *b) {
+            continue;
+        }
+
+        a = str;
+        while (1) {
+            if (*b == 0) {
+                return (char *) str;
+            }
+            if (*a++ != *b++) {
+                break;
+            }
+        }
+        b = substring;
+    }
+
+    return NULL;
+}

ulib/string/string.h

@@ -20,6 +20,7 @@ char *string_tokenizealloc(char *s, char *delim);
 char *string_tokenizealloc_linecontinue(char *s, char *delim);
 char *string_combine(char *dest, const char *src);
 void * string_memmove(void* dest, const void* src, unsigned int n);
+char *string_strstr(const char *str, const char *substring);
 
 #endif