check that the upload path of a file resolves inside the files folder

eNMS-automation · Jan 11, 2024 · 42aac5d · 42aac5d
1 parent b3ec2e6
commit 42aac5d
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/eNMS/controller.py b/eNMS/controller.py
@@ -1494,6 +1494,8 @@ def update_device_rbac(self):
 
     def upload_files(self, **kwargs):
         path = f"{vs.file_path}/{kwargs['folder']}/{kwargs['file'].filename}"
+        if not str(Path(path).resolve()).startswith(str(vs.file_path)):
+            return {"error": "The path resolves outside of the files folder."}
         kwargs["file"].save(path)
 
     def update_pool(self, pool_id):