[asp.net] Fix for bug #467221. Properly match location sub-paths for security trimming

[mono.git] / mcs / class / System.Configuration / System.Configuration / ConfigurationLocation.cs

diff --git a/mcs/class/System.Configuration/System.Configuration/ConfigurationLocation.cs b/mcs/class/System.Configuration/System.Configuration/ConfigurationLocation.cs
index 59dd03e9d0af83c68831f59cb63daec909857d0e..e9669003ee8704eb2c716ba51f16cfad174820a1 100644 (file)
--- a/mcs/class/System.Configuration/System.Configuration/ConfigurationLocation.cs
+++ b/mcs/class/System.Configuration/System.Configuration/ConfigurationLocation.cs
@@ -36,6 +36,8 @@ namespace System.Configuration {
 
        public class ConfigurationLocation
        {
+               static readonly char[] pathTrimChars = { '/' };
+               
                string path;
                Configuration configuration;
                Configuration parent;
@@ -49,6 +51,18 @@ namespace System.Configuration {
                
                internal ConfigurationLocation (string path, string xmlContent, Configuration parent, bool allowOverride)
                {
+                       if (!String.IsNullOrEmpty (path)) {
+                               switch (path [0]) {
+                                       case ' ':
+                                       case '.':
+                                       case '/':
+                                       case '\\':
+                                               throw new ConfigurationErrorsException ("<location> path attribute must be a relative virtual path.  It cannot start with any of ' ' '.' '/' or '\\'.");
+                               }
+
+                               path = path.TrimEnd (pathTrimChars);
+                       }
+                       
                        this.path = path;
                        this.xmlContent = xmlContent;
                        this.parent = parent;
@@ -82,8 +96,8 @@ namespace System.Configuration {
                                        }
                                }
                                
-                               configuration = new Configuration (parent);
-                               using (XmlTextReader tr = new XmlTextReader (new StringReader (xmlContent)))
+                               configuration = new Configuration (parent, path);
+                               using (XmlTextReader tr = new ConfigXmlTextReader (new StringReader (xmlContent), path))
                                        configuration.ReadData (tr, allowOverride);
 
                                xmlContent = null;
@@ -93,6 +107,9 @@ namespace System.Configuration {
                
                internal void SetParentConfiguration (Configuration parent)
                {
+                       if (parentResolved)
+                               return;
+
                        parentResolved = true;
                        this.parent = parent;
                        if (configuration != null)