Backups/OpenList
1
0
Fork 0
mirror of https://github.com/OpenListTeam/OpenList.git synced 2025-09-19 04:06:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): directory traversal (#744)

Browse Source 
* fix(security): Directory traversal

* chore: .

* 优化

---------

Co-authored-by: j2rong4cn <j2rong@qq.com>
This commit is contained in:
hshpy
2025-07-22 14:45:01 +08:00
committed by GitHub
parent a20c2020f8
commit bba4fb2203
4 changed files with 27 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
server/handles/fsbatch.go
View File

@ -11,6 +11,7 @@ import (
"github.com/OpenListTeam/OpenList/v4/internal/model"
"github.com/OpenListTeam/OpenList/v4/internal/op"
"github.com/OpenListTeam/OpenList/v4/pkg/generic"
"github.com/OpenListTeam/OpenList/v4/pkg/utils"
"github.com/OpenListTeam/OpenList/v4/server/common"
"github.com/gin-gonic/gin"
"github.com/pkg/errors"
@ -173,6 +174,11 @@ func FsBatchRename(c *gin.Context) {
if renameObject.SrcName == "" || renameObject.NewName == "" {
continue
}
renameObject.NewName, err = utils.CheckRelativePath(renameObject.NewName)
if err != nil {
common.ErrorResp(c, err, 403)
return
}
filePath := fmt.Sprintf("%s/%s", reqPath, renameObject.SrcName)
if err := fs.Rename(c.Request.Context(), filePath, renameObject.NewName); err != nil {
common.ErrorResp(c, err, 500)
@ -228,10 +234,13 @@ func FsRegexRename(c *gin.Context) {
}
for _, file := range files {
if srcRegexp.MatchString(file.GetName()) {
newFileName, err := utils.CheckRelativePath(srcRegexp.ReplaceAllString(file.GetName(), req.NewNameRegex))
if err != nil {
common.ErrorResp(c, err, 403)
return
}
filePath := fmt.Sprintf("%s/%s", reqPath, file.GetName())
newFileName := srcRegexp.ReplaceAllString(file.GetName(), req.NewNameRegex)
if err := fs.Rename(c.Request.Context(), filePath, newFileName); err != nil {
common.ErrorResp(c, err, 500)
return

3
server/handles/fsmanage.go
View File

@ -204,6 +204,9 @@ func FsRename(c *gin.Context) {
return
}
reqPath, err := user.JoinPath(req.Path)
if err == nil {
req.Name, err = utils.CheckRelativePath(req.Name)
}
if err != nil {
common.ErrorResp(c, err, 403)
return