For regex route /book2/:type:string/fixPath1/:name,urls below can match and value of :type:name can be replaced with evil value. /book2/type1/fixPath1/name1/../../evilType/evilName => :type=evilType :name=evilName /book2/type1/fixPath1/name1/../../././evilType/evilName => :type=evilType :name=evilName /book2/type1/fixPath1/name1/../../././////evilType/evilName=> :type=evilType :name=evilName
Function leafInfo.match() use path.join() to deal with
wildcardValues, which may lead to cross directory risk.*.*can use../to cross directory and set evil value for:path.beego/server/web/tree.go
Line 414 in 64cf44d
beego/server/web/tree.go
Line 431 in 64cf44d
For route
/book1/:name/fixPath1/*.*, urls below can match, and set:path=evil/book1/name1/fixPath1/mybook/../evil.txt=>:name=name1/book1/name1/fixPath1/mybook/../././evil.txt=>:name=name1/book1/name1/fixPath1/mybook/../././////evil.txt=>:name=name1/book1/../fixPath1/mybook/../././////evil.txt=>:name=../book1/./fixPath1/mybook/../././////evil.txt=>:name=.../to cross directory and replace wildcard with evil valuebeego/server/web/tree.go
Line 445 in 64cf44d
For regex route
/book2/:type:string/fixPath1/:name,urls below can match and value of:type:namecan be replaced with evil value./book2/type1/fixPath1/name1/../../evilType/evilName=>:type=evilType :name=evilName/book2/type1/fixPath1/name1/../../././evilType/evilName=>:type=evilType :name=evilName/book2/type1/fixPath1/name1/../../././////evilType/evilName=>:type=evilType :name=evilNameThe text was updated successfully, but these errors were encountered: