blue
/
croc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: check whether path separator + ..

This commit is contained in:
Zack Scholl 2024-09-17 06:39:04 -07:00
parent 519ce8c669
commit 8c4594ad31
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/croc/croc.go
View File

@ -1220,7 +1220,16 @@ func (c *Client) processMessageFileInfo(m message.Message) (done bool, err error
for i, fi := range c.FilesToTransfer { for i, fi := range c.FilesToTransfer {
// Issues #593 - sanitize the sender paths and prevent ".." from being used // Issues #593 - sanitize the sender paths and prevent ".." from being used
c.FilesToTransfer[i].FolderRemote = filepath.Clean(fi.FolderRemote) c.FilesToTransfer[i].FolderRemote = filepath.Clean(fi.FolderRemote)
if strings.Contains(c.FilesToTransfer[i].FolderRemote, "..") { if strings.Contains(c.FilesToTransfer[i].FolderRemote, "../") {
return true, fmt.Errorf("invalid path detected: '%s'", fi.FolderRemote)
}
if strings.Contains(c.FilesToTransfer[i].FolderRemote, "/..") {
return true, fmt.Errorf("invalid path detected: '%s'", fi.FolderRemote)
}
if strings.Contains(c.FilesToTransfer[i].FolderRemote, "\\..") {
return true, fmt.Errorf("invalid path detected: '%s'", fi.FolderRemote)
}
if strings.Contains(c.FilesToTransfer[i].FolderRemote, "..\\") {
return true, fmt.Errorf("invalid path detected: '%s'", fi.FolderRemote) return true, fmt.Errorf("invalid path detected: '%s'", fi.FolderRemote)
} }
// Issues #593 - disallow specific folders like .ssh // Issues #593 - disallow specific folders like .ssh