fix: missing check on upload path
Massimo Melina committed
May 16, 2023 at 22:47 UTC
e7e6ab188dd54313adc39f76bdc9e74c7e6419e1
1 file changed
+4
-2
src/upload.ts
+4
-2
@@ -1,14 +1,14 @@
1
import { statusCodeForMissingPerm, VfsNode } from './vfs'
2
import Koa from 'koa'
3
import {
4
- HTTP_CONFLICT,
4
+ HTTP_CONFLICT, HTTP_FOOL,
5
HTTP_PAYLOAD_TOO_LARGE,
6
HTTP_RANGE_NOT_SATISFIABLE,
7
HTTP_SERVER_ERROR,
8
} from './const'
9
import { basename, dirname, extname, join } from 'path'
10
import fs from 'fs'
11
-import { Callback, try_ } from './misc'
11
+import { Callback, dirTraversal, try_ } from './misc'
12
import { notifyClient } from './frontEndApis'
13
import { defineConfig } from './config'
14
import { getFreeDiskSync } from './util-os'
@@ -23,6 +23,8 @@ const dontOverwriteUploading = defineConfig('dont_overwrite_uploading', false)
23
const waitingToBeDeleted: Record<string, ReturnType<typeof setTimeout>> = {}
24
25
export function uploadWriter(base: VfsNode, path: string, ctx: Koa.Context) {
26
+ if (dirTraversal(path))
27
+ return fail(HTTP_FOOL)
28
if (statusCodeForMissingPerm(base, 'can_upload', ctx))
29
return fail()
30
const fullPath = join(base.source!, path)