Extra argument validation.
Ylian Saint-Hilaire committed
Feb 25, 2025 at 19:57 UTC
f19ad6c66456b313f25b7142ba75af9842fa651f
2 files changed
+3
-2
meshcentral.js
+1
@@ -585,6 +585,7 @@ function CreateMeshCentralServer(config, args) {
585
const child_process = require('child_process');
586
try { if (process.traceDeprecation === true) { startArgs.unshift('--trace-deprecation'); } } catch (ex) { }
587
try { if (process.traceProcessWarnings === true) { startArgs.unshift('--trace-warnings'); } } catch (ex) { }
588
+ if (startArgs[0] != "--disable-proto=delete") startArgs.unshift("--disable-proto=delete")
589
childProcess = child_process.execFile(process.argv[0], startArgs, { maxBuffer: Infinity, cwd: obj.parentpath }, function (error, stdout, stderr) {
590
if (childProcess.xrestart == 1) {
591
setTimeout(function () { obj.launchChildServer(startArgs); }, 500); // This is an expected restart.
meshuser.js
+2
-2
@@ -928,7 +928,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
928
// Get a short file and send it back on the web socket
929
if (common.validateString(command.file, 1, 4096) == false) return;
930
const scpath = meshPathToRealPath(command.path, user); // This will also check access rights
931
- if (scpath == null) break;
931
+ if ((scpath == null) || (command.file !== parent.path.basename(command.file))) break;
932
const filePath = parent.path.join(scpath, command.file);
933
fs.stat(filePath, function (err, stat) {
934
if ((err != null) || (stat == null) || (stat.size >= 204800)) return;
@@ -943,7 +943,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
943
if (common.validateString(command.file, 1, 4096) == false) return;
944
if (typeof command.data != 'string') return;
945
const scpath = meshPathToRealPath(command.path, user); // This will also check access rights
946
- if (scpath == null) break;
946
+ if ((scpath == null) || (command.file !== parent.path.basename(command.file))) break;
947
const filePath = parent.path.join(scpath, command.file);
948
var data = null;
949
try { data = Buffer.from(command.data, 'base64'); } catch (ex) { return; }