RPJosh
/
memories
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sec: better path sanitization 

Signed-off-by: Varun Patil <varunpatil@ucla.edu>
pull/579/head
Varun Patil 2023-04-16 15:58:11 -07:00
parent c25dd6e640
commit 83be3c93b1
3 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/Controller/ArchiveController.php
View File

@ -134,7 +134,7 @@ class ArchiveController extends GenericApiController
} else { } else {
// file not in archive, put it in there // file not in archive, put it in there
$af = \OCA\Memories\Util::$ARCHIVE_FOLDER; $af = \OCA\Memories\Util::$ARCHIVE_FOLDER;
$destinationPath = Exif::removeExtraSlash($af.$relativeFilePath); $destinationPath = Exif::sanitizePath($af.$relativeFilePath);
} }
// Remove the filename // Remove the filename

4
lib/Db/FsManager.php
View File

@ -103,13 +103,13 @@ class FsManager
try { try {
if (null !== $folderPath) { if (null !== $folderPath) {
$folder = $userFolder->get(Exif::removeExtraSlash($folderPath)); $folder = $userFolder->get(Exif::sanitizePath($folderPath));
$root->addFolder($folder); $root->addFolder($folder);
} else { } else {
// Get timeline paths // Get timeline paths
$paths = Exif::getTimelinePaths($uid); $paths = Exif::getTimelinePaths($uid);
if ($path = $this->request->getParam('timelinePath', null)) { if ($path = $this->request->getParam('timelinePath', null)) {
$paths = [Exif::removeExtraSlash($path)]; $paths = [Exif::sanitizePath($path)];
} }
// Combined etag, for cache invalidation. // Combined etag, for cache invalidation.

12
lib/Exif.php
View File

@ -81,15 +81,9 @@ class Exif
*/ */
public static function sanitizePath(string $path) public static function sanitizePath(string $path)
{ {
return mb_ereg_replace('([^\\w\\s\\d\\-_~,;:!@#$&*{}\[\]\'\\[\\]\\(\\).\\\/])', '', $path); $path = mb_ereg_replace('([^\\w\\s\\d\\-_~,;:!@#$&*{}\[\]\'\\[\\]\\(\\).\\\/])', '', $path);
} $path = mb_ereg_replace('\/\/+', '/', $path); // remove extra slashes
return $path;
/**
* Keep only one slash if multiple repeating.
*/
public static function removeExtraSlash(string $path)
{
return mb_ereg_replace('\/\/+', '/', $path);
} }
/** /**