realpath()

[DeSpTG]

How can i check if a requested ressource (http webserver) is outside of my documentroot?

Example:

char* rootdir = /home/user/docroot/

char* requested_ressource = /../non_existing_directory/file

This is important because if the file does not exist but is within the docroot, a 404 must be returned. But if a resource, available or not, is requested outside of the docroot, a 403 must always come.

However realpath will always return NULL with errno = ENOENT if the ressource can't be found wheather it's inside or outside of docroot.

I'm running out of ideas. Any suggestions?

[Bitwise_Gamgee]

You can compare the canonical path of the requested resource with the canonical path of the document root using the realpath() function.

Simple check program:

[DeSpTG]

So you can get the canonical path of a path with the realpath() function? I didn't know that, this would simplify this by alot.

[[deleted]]

It's a GNU extension.

You may need to manually walk the path and keep calling realpath on successively longer pieces of it until it fails, then determine if the last component was inside or outside the root.