1
mirror of https://github.com/rapid7/metasploit-framework synced 2024-11-05 14:57:30 +01:00

Anemone::Page#links: removed upwards dir traversal

[Finishes #47241427]
This commit is contained in:
Tasos Laskos 2013-04-02 00:49:40 +03:00
parent 3a030b2d78
commit f1bc4a76c5

View File

@ -96,32 +96,7 @@ module Anemone
# MODIFIED: Dig URLs from elements other than "A" refs
#
def links
return @links if @links
@links = []
return @links if !doc
@links = run_extractors
@links |= @links.map do |u|
# back-off to the parent dir
to_absolute( URI( u.path.gsub( /(.*\/)[^\/]+$/, "\\1" ) ) ) rescue next
end.uniq.compact
nlinks = []
@links.each do |u|
bits = u.path.split('/')
while(bits.length > 0)
bits.pop
j = bits.join('/')
j = '/' if j.empty?
nlinks << to_absolute(URI(j)) rescue next
end
end
@links |= nlinks
@links.flatten!
@links.uniq!
@links
@links ||= run_extractors
end
#