Determine relative position between two directories - c++

Question

This is for a web server assignment and this is an extra feature that I would like to implement. I would like to ensure that a client cannot specify a file above the servers root directory.
For example, lets say I have a folder "above", and within "above", I have www. I have my root directory set to /above/www in the server, so the server should be able to access anything within /above/www. Lets also say I have some a1.txt in above, so /above/a1.txt, I don't want a client to be able to perform GET /../a1.txt HTTP/1.0 and get access to that file.
I have 90% of the server implemented, I just need to determine if a file is above a given directory in the filesystem tree or if it is below. I can't think of a super easy way of doing that except for counting the ../ strings and if there are more of those than there are folders, I am above my root directory.
I am running linux, and c++11 is acceptable.

Answer 1

Use boost::filesystem::path(relativePath).absolute().parent_path().string() to obtain the absolute path of the directory that the file represented by relativePath lies in. Now, you can simply check that "/above/www" is a prefix of this directory.

Answer 2

My method for completing the task is to use two for loops and strtok.
This may not be the most c++ answer, but it works.
bool within_dir(const char* path, const char* root_dir)
{
assert(path != NULL);
assert(root_dir != NULL);
char *fname_dup, *root_dup, *token;
int root_value, path_value;
// Duplicate char arrays so strtok doesn't damage the originals
fname_dup = (char*)malloc(sizeof(char) * strlen(path) + 1);
assert(fname_dup != NULL);
bzero(fname_dup, sizeof(char) * strlen(path) +1 );
strncpy (fname_dup, path, sizeof(char) * strlen(path));
root_dup = (char*)malloc(sizeof(char) * strlen(root_dir) + 1);
assert(root_dup != NULL);
bzero(root_dup, sizeof(char) * strlen(root_dir)+ 1);
strncpy(root_dup, root_dir, sizeof(char) * strlen(root_dir) );
// Count root directory
for (root_value = 0, token = strtok(root_dup, "/");
token != NULL;
token = strtok(NULL, "/"))
{
if (strcmp(token, "..") == 0)
root_value--;
else
root_value++;
}
// Count and compare path value to root value
for (path_value = 0, token = strtok(fname_dup, "/");
token != NULL;
token = strtok(NULL, "/"))
{
if (strcmp(token, "..") == 0)
{
path_value--;
if (path_value < root_value)
{
free(root_dup);
free(fname_dup);
return false;
}
}
else
path_value++;
}
free(root_dup);
free(fname_dup);
return true;
}
Basically the code runs through and counts up how "positive" or "negative" the root is. Going up a level is negative, and going down a level is positive. Once it knows the value of the root, if the value of the file path ever goes below the value of the root, we know that the filepath must go up at least one layer above the root directory, and therefore is invalid. Since we don't actually care about the actual value, only if it goes up a layer from the root directory, we immediately stop and return false. If the filepath always remains more positive than the root, then the filepath will always be lower on the filetree. No guarantees are made for links.