Backups/OpenList
1
0
Fork 0
mirror of https://github.com/OpenListTeam/OpenList.git synced 2025-09-20 20:56:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): directory traversal (#744)

Browse Source 
* fix(security): Directory traversal

* chore: .

* 优化

---------

Co-authored-by: j2rong4cn <j2rong@qq.com>
This commit is contained in:
hshpy
2025-07-22 14:45:01 +08:00
committed by GitHub
parent a20c2020f8
commit bba4fb2203
4 changed files with 27 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
pkg/utils/path.go
View File

@ -75,20 +75,20 @@ func EncodePath(path string, all ...bool) string {
}
func JoinBasePath(basePath, reqPath string) (string, error) {
/** relative path:
* 1. ..
* 2. ../
* 3. /..
* 4. /../
* 5. /a/b/..
*/
if reqPath == ".." ||
strings.HasSuffix(reqPath, "/..") ||
strings.HasPrefix(reqPath, "../") ||
strings.Contains(reqPath, "/../") {
reqPath, err := CheckRelativePath(reqPath)
if err != nil {
return "", err
}
return stdpath.Join(FixAndCleanPath(basePath), reqPath), nil
}
func CheckRelativePath(path string) (string, error) {
isRelativePath := strings.Contains(path, "..")
path = FixAndCleanPath(path)
if isRelativePath && !strings.Contains(path, "..") {
return "", errs.RelativePath
}
return stdpath.Join(FixAndCleanPath(basePath), FixAndCleanPath(reqPath)), nil
return path, nil
}
func GetFullPath(mountPath, path string) string {