vincent/aptly
1
0
Fork 0
mirror of https://github.com/aptly-dev/aptly.git synced 2026-06-10 06:14:22 +00:00
Code Issues Projects Releases Wiki Activity

Sanitize path api params

Browse Source 
- fix path traversal complains by CodeQL
This commit is contained in:
André Roth
2024-10-10 18:54:03 +02:00
parent ce2966e547
commit 57639c4adf
4 changed files with 30 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/files.go
+8 -5
View File
@@ -8,6 +8,7 @@ import (
"strings"
"sync"
"github.com/aptly-dev/aptly/utils"
"github.com/gin-gonic/gin"
"github.com/saracen/walker"
)
@@ -72,7 +73,7 @@ func apiFilesUpload(c *gin.Context) {
return
}
path := filepath.Join(context.UploadPath(), c.Params.ByName("dir"))
path := filepath.Join(context.UploadPath(), utils.PathSanitize(c.Params.ByName("dir")))
err := os.MkdirAll(path, 0777)
if err != nil {
@@ -128,7 +129,7 @@ func apiFilesListFiles(c *gin.Context) {
list := []string{}
listLock := &sync.Mutex{}
root := filepath.Join(context.UploadPath(), c.Params.ByName("dir"))
root := filepath.Join(context.UploadPath(), utils.PathSanitize(c.Params.ByName("dir")))
err := filepath.Walk(root, func(path string, _ os.FileInfo, err error) error {
if err != nil {
@@ -164,7 +165,7 @@ func apiFilesDeleteDir(c *gin.Context) {
return
}
err := os.RemoveAll(filepath.Join(context.UploadPath(), c.Params.ByName("dir")))
err := os.RemoveAll(filepath.Join(context.UploadPath(), utils.PathSanitize(c.Params.ByName("dir"))))
if err != nil {
AbortWithJSONError(c, 500, err)
return
@@ -179,12 +180,14 @@ func apiFilesDeleteFile(c *gin.Context) {
return
}
if !verifyPath(c.Params.ByName("name")) {
dir := utils.PathSanitize(c.Params.ByName("dir"))
name := utils.PathSanitize(c.Params.ByName("name"))
if !verifyPath(name) {
AbortWithJSONError(c, 400, fmt.Errorf("wrong file"))
return
}
err := os.Remove(filepath.Join(context.UploadPath(), c.Params.ByName("dir"), c.Params.ByName("name")))
err := os.Remove(filepath.Join(context.UploadPath(), dir, name))
if err != nil {
if err1, ok := err.(*os.PathError); !ok || !os.IsNotExist(err1.Err) {
AbortWithJSONError(c, 500, err)