From 542fe18dcd9ba8c6af07a580cff024c7052aae64 Mon Sep 17 00:00:00 2001 From: Julien Neuhart Date: Fri, 5 Jun 2020 12:06:01 +0200 Subject: [PATCH] avoir directory traversal when uploading a file --- internal/app/xhttp/pkg/context/context.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/internal/app/xhttp/pkg/context/context.go b/internal/app/xhttp/pkg/context/context.go index 9e5fd11c..b0ddb7c4 100644 --- a/internal/app/xhttp/pkg/context/context.go +++ b/internal/app/xhttp/pkg/context/context.go @@ -8,6 +8,7 @@ import ( "strconv" "strings" "time" + "path/filepath" "github.com/labstack/echo/v4" "github.com/thecodingmachine/gotenberg/internal/app/xhttp/pkg/resource" @@ -106,7 +107,9 @@ func (ctx *Context) WithResource(directoryName string) error { return r, err } defer in.Close() // nolint: errcheck - if err := r.WithFile(fh.Filename, in); err != nil { + // avoid directory traversal. + filename := filepath.Base(fh.Filename) + if err := r.WithFile(filename, in); err != nil { return r, err } }