Mirrors/kararas_iris
1
0
Fork 0
mirror of https://github.com/kataras/iris.git synced 2025-12-26 06:17:03 +00:00
Code Releases Activity

context.UploadFormFiles: security fix

Browse Source
This commit is contained in:
Gerasimos (Makis) Maropoulos
2020-12-27 13:23:14 +02:00
parent e2b481dea1
commit 8fef8fd04c
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
context/context.go
View File

@@ -1974,6 +1974,13 @@ func (ctx *Context) UploadFormFiles(destDirectory string, before ...func(*Contex
for _, files := range fhs {
innerLoop:
for _, file := range files {
// Fix an issue that net/http has,
// an attacker can push a filename
// which could lead to override existing system files
// by ../../$file.
// Reported by Frank through security reports.
file.Filename = strings.TrimLeft(file.Filename, "../")
file.Filename = strings.TrimLeft(file.Filename, "..\\")
for _, b := range before {
if !b(ctx, file) {