Merge pull request from GHSA-h5gf-cmm8-cg7c

IceWhaleTech · Feb 4, 2024 · 3f4558e · 3f4558e
1 parent 4d2b65e
commit 3f4558e
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/route/v1/user.go b/route/v1/user.go
@@ -13,6 +13,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -667,6 +668,16 @@ func GetUserImage(c *gin.Context) {
 		return
 	}
 
+	matched, err := regexp.MatchString(`^/var/lib/casaos/\d`, filePath)
+	if err != nil {
+		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
+		return
+	}
+	if !matched {
+		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
+		return
+	}
+
 	fileTmp, _ := os.Open(filePath)
 	defer fileTmp.Close()