xbmc/xbmc — pull request #1480 by Montellese (2012-09-26 06:40:12+00:00)
Title: webserver: make VFS handler more secure

These commits are meant to make the VFS handler of xbmc's webserver more secure. Currently it allows to access any file which xbmc can reach through its VFS including files like /etc/passwd etc because the only check that is made is whether the file exists or not.

With these commits every requested VFS path will be checked against the list of user-specified sources. If the path does not point to a file within a (sub-)directory of one of those sources a HTTP 401 (Unauthorized) error is returned. For this to work I had to write a method which would take care of ".." etc in paths because otherwise it would be possible to do something like
```
/path/to/source/../../../etc/passwd
```
and still access any file. I don't think the implementation is optimal but I couldn't find an existing method that does the same so I wrote URIUtils::GetRealPath() (and I also wrote a unit test for it).

IMO this is the best way to make the VFS handler more secure (short of ripping it out which I plan to do once there is a better way to access media files through the webserver). If someone adds the root path as a source it's his own fault. And if someone adds a symlink to the root directory (or somewhere else) in one of his source directories it's his own problem as well.