webserver: refuse to follow symlink when serving ACME challenge responses.

1 files changed, 5 insertions, 1 deletions

diff --git a/webserver b/webserver
index 7914762..21486ae 100755
--- a/webserver
+++ b/webserver
@@ -91,7 +91,11 @@ while (1) {
     while (defined (my $h = $conn->getline())) { last if $h eq "\r\n" };
 
     my ($status_line, $content_type, $content);
-    if ($req =~ /\A\Q$ROOT\E\/([A-Za-z0-9_\-]+)\z/ and -f $1) {
+    if ($req =~ /\A\Q$ROOT\E\/([A-Za-z0-9_\-]+)\z/ and
+            ! -l $1 and -f _) { # reuse previous stat structure and save a syscall
+        # XXX calling lstat(2) before open(2) is racy; if O_NOFOLLOW was
+        # exposed to perl we would instead use it and later fstat(2) the
+        # file descriptor
         if (open my $fh, '<', $1) { # only open files in the cwd
             ($status_line, $content_type) = ('200 OK', 'application/jose+json');
             $content = do { local $/ = undef; $fh->getline() };