liz/wikijs-fork
liz/wikijs-fork
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: strip directory traversal sequences from asset paths

Browse Source
This commit is contained in:
NGPixel 2020-10-03 01:44:57 -04:00
parent 9ccd1f82e9
commit 084dcd69d1
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
server/helpers/page.js
View File

@ -5,6 +5,8 @@ const path = require('path')
const localeSegmentRegex = /^[A-Z]{2}(-[A-Z]{2})?$/i const localeSegmentRegex = /^[A-Z]{2}(-[A-Z]{2})?$/i
const localeFolderRegex = /^([a-z]{2}(?:-[a-z]{2})?\/)?(.*)/i const localeFolderRegex = /^([a-z]{2}(?:-[a-z]{2})?\/)?(.*)/i
// eslint-disable-next-line no-control-regex
const unsafeCharsRegex = /[\x00-\x1f\x80-\x9f\\"|<>:*?]/
const contentToExt = { const contentToExt = {
markdown: 'md', markdown: 'md',
@ -30,10 +32,14 @@ module.exports = {
// Clean Path // Clean Path
rawPath = _.trim(qs.unescape(rawPath)) rawPath = _.trim(qs.unescape(rawPath))
if (_.startsWith(rawPath, '/')) { rawPath = rawPath.substring(1) } if (_.startsWith(rawPath, '/')) { rawPath = rawPath.substring(1) }
rawPath = rawPath.replace(unsafeCharsRegex, '')
if (rawPath === '') { rawPath = 'home' } if (rawPath === '') { rawPath = 'home' }
// Extract Info // Extract Info
let pathParts = _.filter(_.split(rawPath, '/'), p => !_.isEmpty(p)) let pathParts = _.filter(_.split(rawPath, '/'), p => {
p = _.trim(p)
return !_.isEmpty(p) && p !== '..' && p !== '.'
})
if (pathParts[0].length === 1) { if (pathParts[0].length === 1) {
pathParts.shift() pathParts.shift()
} }
@ -73,7 +79,7 @@ module.exports = {
['date', page.updatedAt], ['date', page.updatedAt],
['tags', page.tags ? page.tags.map(t => t.tag).join(', ') : ''], ['tags', page.tags ? page.tags.map(t => t.tag).join(', ') : ''],
['editor', page.editorKey], ['editor', page.editorKey],
['dateCreated', page.createdAt], ['dateCreated', page.createdAt]
] ]
switch (page.contentType) { switch (page.contentType) {
case 'markdown': case 'markdown':