liz/wikijs-fork
liz/wikijs-fork
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: asset path traversal on windows

Browse Source
This commit is contained in:
NGPixel 2021-12-03 22:30:22 -05:00
parent 112d070730
commit 414033de9d
No known key found for this signature in database
GPG Key ID: 8FDA2F1757F60D63
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
server/helpers/page.js
View File

@ -35,6 +35,8 @@ module.exports = {
rawPath = rawPath.replace(unsafeCharsRegex, '') rawPath = rawPath.replace(unsafeCharsRegex, '')
if (rawPath === '') { rawPath = 'home' } if (rawPath === '') { rawPath = 'home' }
rawPath = rawPath.replaceAll('\\', '').replaceAll('//', '').replaceAll(/\.\.+/ig, '')
// Extract Info // Extract Info
let pathParts = _.filter(_.split(rawPath, '/'), p => { let pathParts = _.filter(_.split(rawPath, '/'), p => {
p = _.trim(p) p = _.trim(p)