fix: having upload permission in a folder, you could upload outside of it (but without deciding the filename)
Massimo Melina committed
Jan 17, 2026 at 00:56 UTC
5d765a59c54ad2d6131d36a93013debf49f4ec77
2 files changed
+2
-1
src/util-files.ts
+1
-1
@@ -156,7 +156,7 @@ export async function createSafeWriteStream(path: string, options?: Parameters<t
156
}
157
158
export function isValidFileName(name: string) {
159
- return !(IS_WINDOWS ? /[/:"*?<>|\\]/ : /\//).test(name) && !hasDirTraversal(name)
159
+ return name !== '.' && !(IS_WINDOWS ? /[/:"*?<>|\\]/ : /\//).test(name) && !hasDirTraversal(name)
160
}
161
162
export function exists(path: string) {
tests/test.ts
+1
@@ -249,6 +249,7 @@ describe('after-login', () => {
249
test('inherit.disabled', reqList('/for-disabled/', 401))
250
test('upload.never', reqUpload('/random', 403))
251
test('upload.ok', reqUpload(UPLOAD_DEST, 200))
252
+ test('upload.dot name', reqUpload(`${UPLOAD_ROOT}%2e`, 418))
253
test('upload.temp hash requires auth', async () => {
254
const rel = `${UPLOAD_DIR}/partial.png`
255
await reqUpload(`${UPLOAD_ROOT}${rel}?partial=1`, 204)()