From: mfranz <mfranz>
Date: Tue, 17 Jul 2007 14:52:51 +0000 (+0000)
Subject: - close loophole through which one could sneak in illegal property names
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=23c7a1b5b7401cc36b24ac7b238eb7d3edcde070;p=simgear.git

- close loophole through which one could sneak in illegal property names
  containing slashes, colons and all sorts of evil characters. In Nasal
  this could be done via props.globals.getChild("1!@#$//[]{}", 0, 1).setValue(0);
  The cause is that getChild() hands the given name directly over to an
  alternative SGPropertyNode ("convenience") constructor which sets the
  name without any checks.
- unify exception messages: first character is lower case
---

diff --git a/simgear/props/props.cxx b/simgear/props/props.cxx
index aa639616..aa37f1db 100644
--- a/simgear/props/props.cxx
+++ b/simgear/props/props.cxx
@@ -116,7 +116,7 @@ parse_name (const string &path, int &i)
       name = ".";
     }
     if (i < max && path[i] != '/')
-      throw string("Illegal character after " + name);
+      throw string("illegal character after " + name);
   }
 
   else if (isalpha(path[i]) || path[i] == '_') {
@@ -295,7 +295,7 @@ find_node (SGPropertyNode * current,
   else if (components[position].name == "..") {
     SGPropertyNode * parent = current->getParent();
     if (parent == 0)
-      throw string("Attempt to move past root with '..'");
+      throw string("attempt to move past root with '..'");
     else
       return find_node(parent, components, position + 1, create);
   }
@@ -739,7 +739,11 @@ SGPropertyNode::SGPropertyNode (const char * name,
     _attr(READ|WRITE),
     _listeners(0)
 {
-  _name = name;
+  int i = 0;
+  _name = parse_name(name, i);
+  if (i != int(strlen(name)) || name[0] == '.')
+    throw string("plain name expected instead of '") + name + '\'';
+
   _local_val.string_val = 0;
 }