Themes: Restrict path traversal in locate_template().

Props jeremyfelt, marcs0h, vortfu, jorbin, fiocavallari, xknown, sirlouen, joemcgill, pypwalters, swissspidy, shailu25, oglekler, peterwilsoncc, mukesh27, audrasjb, wildworks, rajinsharwar, martinkrcho, jeffpaul, ressl.

Merges r63792 into the 5.0 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/5.0@63827 602fd350-edb4-49c9-b593-d223f7449a82

Author: johnbillion

src/wp-includes/template.php

@@ -419,7 +419,7 @@ function get_page_template() {
 		$templates[] = $template;
 	if ( $pagename ) {
 		$pagename_decoded = urldecode( $pagename );
-		if ( $pagename_decoded !== $pagename ) {
+		if ( $pagename_decoded !== $pagename && 0 === validate_file( $pagename_decoded ) ) {
 			$templates[] = "page-{$pagename_decoded}.php";
 		}
 		$templates[] = "page-{$pagename}.php";
@@ -613,13 +613,70 @@ function get_attachment_template() {
 	return get_query_template( 'attachment', $templates );
 }
 
+/**
+ * Determines whether a template found by locate_template() may be loaded.
+ *
+ * @since 7.1.2
+ * @access private
+ *
+ * @param string $path Path to an existing template file.
+ * @return bool Whether the template may be loaded.
+ */
+function _wp_is_template_path_allowed( $path ) {
+	// A file path that exists and does not contain `..` is allowed.
+	if ( 0 === preg_match( '#(?:^|/)\.\.[. ]*(?:/|$)#', wp_normalize_path( $path ) ) ) {
+		return true;
+	}
+
+	// Resolve the true location of the requested file for later comparison.
+	$real_path = realpath( $path );
+
+	if ( false === $real_path ) {
+		return false;
+	}
+
+	$real_path = trailingslashit( wp_normalize_path( $real_path ) );
+
+	$directories = array(
+		STYLESHEETPATH,
+		TEMPLATEPATH,
+		ABSPATH . WPINC . '/theme-compat',
+	);
+
+	// If a theme is in a subdirectory, accept templates from its direct parent directory.
+	if ( false !== strpos( get_stylesheet(), '/' ) ) {
+		$directories[] = dirname( STYLESHEETPATH );
+	}
+
+	// If a parent theme is in a subdirectory, accept templates from its direct parent directory.
+	if ( false !== strpos( get_template(), '/' ) ) {
+		$directories[] = dirname( TEMPLATEPATH );
+	}
+
+	foreach ( $directories as $directory ) {
+		$real_directory = realpath( $directory );
+
+		if ( false === $real_directory ) {
+			continue;
+		}
+
+		// The true location of the requested file must be inside one of the allowed directories.
+		if ( 0 === strpos( $real_path, trailingslashit( wp_normalize_path( $real_directory ) ) ) ) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
 /**
  * Retrieve the name of the highest priority template file that exists.
  *
  * Searches in the STYLESHEETPATH before TEMPLATEPATH and wp-includes/theme-compat
  * so that themes which inherit from a parent theme can just overload one file.
  *
  * @since 2.7.0
+ * @since 7.1.2 A template name containing `..` is only located if it resolves inside the theme.
  *
  * @param string|array $template_names Template file(s) to search for, in order.
  * @param bool         $load           If true the template file will be loaded if it is found.
@@ -632,13 +689,17 @@ function locate_template($template_names, $load = false, $require_once = true )
 		if ( !$template_name )
 			continue;
 		if ( file_exists(STYLESHEETPATH . '/' . $template_name)) {
-			$located = STYLESHEETPATH . '/' . $template_name;
-			break;
+			$candidate = STYLESHEETPATH . '/' . $template_name;
 		} elseif ( file_exists(TEMPLATEPATH . '/' . $template_name) ) {
-			$located = TEMPLATEPATH . '/' . $template_name;
-			break;
+			$candidate = TEMPLATEPATH . '/' . $template_name;
 		} elseif ( file_exists( ABSPATH . WPINC . '/theme-compat/' . $template_name ) ) {
-			$located = ABSPATH . WPINC . '/theme-compat/' . $template_name;
+			$candidate = ABSPATH . WPINC . '/theme-compat/' . $template_name;
+		} else {
+			continue;
+		}
+
+		if ( _wp_is_template_path_allowed( $candidate ) ) {
+			$located = $candidate;
 			break;
 		}
 	}