Item13883: improve filename validation (Item15163)

foswiki · Aug 5, 2022 · a5ec350 · a5ec350
1 parent a71f1a5
commit a5ec350
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 3 deletions.
diff --git a/core/lib/Foswiki/Sandbox.pm b/core/lib/Foswiki/Sandbox.pm
@@ -199,6 +199,10 @@ sub validateAttachmentName {
     my @result;
     foreach my $component (@dirs) {
         return unless defined($component) && $component ne '';
+
+        # Filter nasty characters
+        $component =~ s/$Foswiki::cfg{AttachmentNameFilter}//g;
+
         next if $component eq '.';
         if ( $component eq '..' ) {
             if ( scalar(@result) ) {
@@ -214,9 +218,6 @@ sub validateAttachmentName {
             }
         }
         else {
-
-            # Filter nasty characters
-            $component =~ s/$Foswiki::cfg{AttachmentNameFilter}//g;
             push( @result, $component );
         }
     }

diff --git a/core/lib/Foswiki/UI/Viewfile.pm b/core/lib/Foswiki/UI/Viewfile.pm
@@ -153,6 +153,17 @@ sub viewfile {
     $fileName = Foswiki::Sandbox::untaint( $fileName,
         \&Foswiki::Sandbox::validateAttachmentName );
 
+    if ( !$fileName ) {
+        throw Foswiki::OopsException(
+            'attention',
+            def    => 'no_such_attachment',
+            web    => $web,
+            topic  => $topic,
+            status => 404,
+            params => ['?']
+        );
+    }
+
     #print STDERR "VIEWFILE: web($web), topic($topic), file($fileName)\n";
 
     my $rev = Foswiki::Store::cleanUpRevID( scalar( $query->param('rev') ) );