adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-08-17 04:32:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

avoir directory traversal when uploading a file

Browse Source
This commit is contained in:
Julien Neuhart
2020-06-05 12:06:01 +02:00
parent 25f18ac951
commit 542fe18dcd
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
internal/app/xhttp/pkg/context/context.go
View File

@@ -8,6 +8,7 @@ import (
"strconv" "strconv"
"strings" "strings"
"time" "time"
"path/filepath"
"github.com/labstack/echo/v4" "github.com/labstack/echo/v4"
"github.com/thecodingmachine/gotenberg/internal/app/xhttp/pkg/resource" "github.com/thecodingmachine/gotenberg/internal/app/xhttp/pkg/resource"
@@ -106,7 +107,9 @@ func (ctx *Context) WithResource(directoryName string) error {
return r, err return r, err
} }
defer in.Close() // nolint: errcheck defer in.Close() // nolint: errcheck
if err := r.WithFile(fh.Filename, in); err != nil { // avoid directory traversal.
filename := filepath.Base(fh.Filename)
if err := r.WithFile(filename, in); err != nil {
return r, err return r, err
} }
} }