From 23c7a1b5b7401cc36b24ac7b238eb7d3edcde070 Mon Sep 17 00:00:00 2001
From: mfranz <mfranz>
Date: Tue, 17 Jul 2007 14:52:51 +0000
Subject: [PATCH] - close loophole through which one could sneak in illegal
 property names   containing slashes, colons and all sorts of evil characters.
 In Nasal   this could be done via props.globals.getChild("1!@#$//[]{}", 0,
 1).setValue(0);   The cause is that getChild() hands the given name directly
 over to an   alternative SGPropertyNode ("convenience") constructor which
 sets the   name without any checks. - unify exception messages: first
 character is lower case

---
 simgear/props/props.cxx | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/simgear/props/props.cxx b/simgear/props/props.cxx
index aa639616..aa37f1db 100644
--- a/simgear/props/props.cxx
+++ b/simgear/props/props.cxx
@@ -116,7 +116,7 @@ parse_name (const string &path, int &i)
       name = ".";
     }
     if (i < max && path[i] != '/')
-      throw string("Illegal character after " + name);
+      throw string("illegal character after " + name);
   }
 
   else if (isalpha(path[i]) || path[i] == '_') {
@@ -295,7 +295,7 @@ find_node (SGPropertyNode * current,
   else if (components[position].name == "..") {
     SGPropertyNode * parent = current->getParent();
     if (parent == 0)
-      throw string("Attempt to move past root with '..'");
+      throw string("attempt to move past root with '..'");
     else
       return find_node(parent, components, position + 1, create);
   }
@@ -739,7 +739,11 @@ SGPropertyNode::SGPropertyNode (const char * name,
     _attr(READ|WRITE),
     _listeners(0)
 {
-  _name = name;
+  int i = 0;
+  _name = parse_name(name, i);
+  if (i != int(strlen(name)) || name[0] == '.')
+    throw string("plain name expected instead of '") + name + '\'';
+
   _local_val.string_val = 0;
 }
 
-- 
2.39.5