Mirrors/kararas_iris
1
0
Fork 0
mirror of https://github.com/kataras/iris.git synced 2025-12-18 02:17:05 +00:00
Code Releases Activity

minor

Browse Source
This commit is contained in:
Gerasimos (Makis) Maropoulos
2023-11-04 00:48:09 +02:00
parent 4d13ff3622
commit b12965b050
2 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
context/context.go
View File

@@ -2456,23 +2456,26 @@ func (ctx *Context) UploadFormFiles(destDirectory string, before ...func(*Contex
destPath := filepath.Join(destDirectory, filename)
// Get the canonical path of the destination
canonicalDestPath, err := filepath.EvalSymlinks(destPath)
if err != nil {
return nil, 0, err
}
// canonicalDestPath, err := filepath.EvalSymlinks(destPath)
// if err != nil {
// return nil, 0, fmt.Errorf("dest path: %s: eval symlinks: %w", destPath, err)
// }
// ^ No, it will try to find the file before uploaded.
// Get the canonical path of the destination directory.
canonicalDestDir, err := filepath.EvalSymlinks(destDirectory)
canonicalDestDir, err := filepath.EvalSymlinks(destDirectory) // the destDirectory should exists.
if err != nil {
return nil, 0, err
return nil, 0, fmt.Errorf("dest directory: %s: eval symlinks: %w", destDirectory, err)
}
// Check if the destination path is within the destination directory.
if !strings.HasPrefix(canonicalDestPath, canonicalDestDir) {
if !strings.HasPrefix(destPath, canonicalDestDir) {
// Reject the input as it is a path traversal attempt.
continue innerLoop
}
file.Filename = filename
n0, err0 := ctx.SaveFormFile(file, destPath)
if err0 != nil {
return nil, 0, err0