From 96303f5d32cf63b248b9fd53a30f630d158ad7f8 Mon Sep 17 00:00:00 2001 From: Serhii Mudryk Date: Sat, 8 Aug 2026 17:28:55 +0300 Subject: [PATCH] Correct cleanup of temporary directories after multiple file uploads fixes: #119 --- go.mod | 4 ++-- go.sum | 8 ++++---- shell2http.go | 13 ++++++++----- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/go.mod b/go.mod index d496ae0..f4ff707 100644 --- a/go.mod +++ b/go.mod @@ -3,6 +3,6 @@ module github.com/msoap/shell2http go 1.18 require ( - github.com/mattn/go-shellwords v1.0.12 - github.com/msoap/raphanus v0.14.3 + github.com/mattn/go-shellwords v1.0.14 + github.com/msoap/raphanus v0.14.5 ) diff --git a/go.sum b/go.sum index d65e53d..71a8f1c 100644 --- a/go.sum +++ b/go.sum @@ -11,12 +11,12 @@ github.com/labstack/gommon v0.3.1/go.mod h1:uW6kP17uPlLJsD3ijUYn3/M5bAxtlZhMI6m3 github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= -github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk= -github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y= +github.com/mattn/go-shellwords v1.0.14 h1:yUKzIgsCnosndOASY6/enly1EAuaXeFSQ7cdyA3OuYg= +github.com/mattn/go-shellwords v1.0.14/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y= github.com/mediocregopher/radix.v2 v0.0.0-20181115013041-b67df6e626f9 h1:ViNuGS149jgnttqhc6XQNPwdupEMBXqCx9wtlW7P3sA= github.com/mediocregopher/radix.v2 v0.0.0-20181115013041-b67df6e626f9/go.mod h1:fLRUbhbSd5Px2yKUaGYYPltlyxi1guJz1vCmo1RQL50= -github.com/msoap/raphanus v0.14.3 h1:K2STroHMcezFAttTu306HEUDuTrc20eKYIxeELMCs0A= -github.com/msoap/raphanus v0.14.3/go.mod h1:88EzBFijRfUHAX3JQMgM3JcIf+0NKRMliZIio7+8CIY= +github.com/msoap/raphanus v0.14.5 h1:eoJ1UTeoSoghN/mr1NudCwRgFJ/WIZY/IGKtv3ETplo= +github.com/msoap/raphanus v0.14.5/go.mod h1:88EzBFijRfUHAX3JQMgM3JcIf+0NKRMliZIio7+8CIY= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= diff --git a/shell2http.go b/shell2http.go index 7f2273f..c6a94d6 100644 --- a/shell2http.go +++ b/shell2http.go @@ -7,7 +7,6 @@ import ( "fmt" "html" "io" - "io/ioutil" "log" "mime/multipart" "net" @@ -429,10 +428,10 @@ func parseCGIHeaders(shellOut string) (string, map[string]string) { // getForm - parse form into environment vars, also handle uploaded files func getForm(cmd *exec.Cmd, req *http.Request, checkFormRe *regexp.Regexp) (func(), error) { - tempDir := "" + tempDirs := []string{} safeFileNameRe := regexp.MustCompile(`[^\.\w\-]+`) finalizer := func() { - if tempDir != "" { + for _, tempDir := range tempDirs { if err := os.RemoveAll(tempDir); err != nil { log.Println(err) } @@ -474,6 +473,7 @@ func getForm(cmd *exec.Cmd, req *http.Request, checkFormRe *regexp.Regexp) (func var ( uplFile multipart.File outFile *os.File + tempDir string err error reqFileName = value[0].Filename ) @@ -482,11 +482,14 @@ func getForm(cmd *exec.Cmd, req *http.Request, checkFormRe *regexp.Regexp) (func uplFile, err = value[0].Open() return err }, func() error { - tempDir, err = ioutil.TempDir("", "shell2http_") + tempDir, err = os.MkdirTemp("", "shell2http_") + if err == nil { + tempDirs = append(tempDirs, tempDir) + } return err }, func() error { prefix := safeFileNameRe.ReplaceAllString(reqFileName, "") - outFile, err = ioutil.TempFile(tempDir, prefix+"_") + outFile, err = os.CreateTemp(tempDir, prefix+"_") return err }, func() error { _, err = io.Copy(outFile, uplFile)