Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-21 09:00:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🧑‍💻 Improve kernel API /api/file/putFile parameter validation https://github.com/siyuan-note/siyuan/issues/14658

Browse source
This commit is contained in:
Daniel 2025-04-20 10:53:16 +08:00
parent 7af3d78e54
commit cc2239f969
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
kernel/api/file.go
View file

@ -380,6 +380,12 @@ func putFile(c *gin.Context) {
return return
} }
if !isValidFileName(fileAbsPath) { // Improve kernel API `/api/file/putFile` parameter validation https://github.com/siyuan-note/siyuan/issues/14658
ret.Code = http.StatusBadRequest
ret.Msg = "invalid file path, please check https://github.com/siyuan-note/siyuan/issues/14658 for more details"
return
}
isDirStr := c.PostForm("isDir") isDirStr := c.PostForm("isDir")
isDir, _ := strconv.ParseBool(isDirStr) isDir, _ := strconv.ParseBool(isDirStr)
@ -459,3 +465,8 @@ func millisecond2Time(t int64) time.Time {
msec := t % 1000 msec := t % 1000
return time.Unix(sec, msec*int64(time.Millisecond)) return time.Unix(sec, msec*int64(time.Millisecond))
} }
func isValidFileName(p string) bool {
name := filepath.Base(p)
return name == util.FilterUploadFileName(name)
}