luci-base: don't propagate null bytes in path information

It is possible to inject unescaped markup using a double encoded null byte
via PATH_INFO on certain leaf nodes.

Since there is no legitimate reason to handle null bytes in any part of the
requested url, simply skip over such bytes when parsing the PATH_INFO value.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index 91b86679fd739bc5ba67deb47258a9c46c09d0c5..fc497ca9f34f548dfa15e5515b88674f1325ffe0 100644 (file)
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -113,7 +113,8 @@ function httpdispatch(request, prefix)
                end
        end
 
-       for node in pathinfo:gmatch("[^/]+") do
+       local node
+       for node in pathinfo:gmatch("[^/%z]+") do
                r[#r+1] = node
        end