Skip to content

Commit

Permalink
Merge pull request #1232 from nextcloud/backport-1224-do-not-allow-li…
Browse files Browse the repository at this point in the history
…nebreak-in-paths-9

[stable9] Do not allow linebreaks and null bytes in paths
  • Loading branch information
rullzer authored Sep 1, 2016
2 parents a98e66d + 1352365 commit 28a05a2
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 2 deletions.
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,7 @@ nbproject
/build/lib/
/build/jsdocs/
/npm-debug.log
/PhantomJS_*

# puphpet
puphpet
Expand Down
8 changes: 7 additions & 1 deletion apps/files/js/filelist.js
Original file line number Diff line number Diff line change
Expand Up @@ -1327,14 +1327,20 @@
return OC.linkTo('files', 'index.php')+"?dir="+ encodeURIComponent(dir).replace(/%2F/g, '/');
},

/**
* @param {string} path
* @returns {boolean}
*/
_isValidPath: function(path) {
var sections = path.split('/');
for (var i = 0; i < sections.length; i++) {
if (sections[i] === '..') {
return false;
}
}
return true;

return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 &&
path.toLowerCase().indexOf(decodeURI('%00')) === -1;
},

/**
Expand Down
4 changes: 3 additions & 1 deletion apps/files/tests/js/filelistSpec.js
Original file line number Diff line number Diff line change
Expand Up @@ -1333,9 +1333,11 @@ describe('OCA.Files.FileList tests', function() {
'/abc/..',
'/abc/../',
'/../abc/',
'/foo%0Abar/',
'/foo%00bar/',
'/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../'
], function(path) {
fileList.changeDirectory(path);
fileList.changeDirectory(decodeURI(path));
expect(fileList.getCurrentDirectory()).toEqual('/');
});
});
Expand Down

0 comments on commit 28a05a2

Please sign in to comment.