github
/
alist
mirror of https://github.com/Xhofe/alist
1
0
Fork 0
Code Issues Releases Wiki Activity

fix: relative path judgment (close #3130)

pull/3157/head
Noah Hsu 2023-01-23 15:50:49 +08:00
parent 28875ce304
commit b42ec3e810
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/utils/path.go
View File

@ -75,7 +75,17 @@ func EncodePath(path string, all ...bool) string {
} }
func JoinBasePath(basePath, reqPath string) (string, error) { func JoinBasePath(basePath, reqPath string) (string, error) {
if strings.HasSuffix(reqPath, "..") || strings.Contains(reqPath, "../") { /** relative path:
* 1. ..
* 2. ../
* 3. /..
* 4. /../
* 5. /a/b/..
*/
if reqPath == ".." ||
strings.HasSuffix(reqPath, "/..") ||
strings.HasPrefix(reqPath, "../") ||
strings.Contains(reqPath, "/../") {
return "", errs.RelativePath return "", errs.RelativePath
} }
return stdpath.Join(FixAndCleanPath(basePath), FixAndCleanPath(reqPath)), nil return stdpath.Join(FixAndCleanPath(basePath), FixAndCleanPath(reqPath)), nil