Merge pull request #1232 from nextcloud/backport-1224-do-not-allow-li…

…nebreak-in-paths-9

[stable9] Do not allow linebreaks and null bytes in paths

.gitignore

@@ -104,6 +104,7 @@ nbproject
 /build/lib/
 /build/jsdocs/
 /npm-debug.log
+/PhantomJS_*
 
 # puphpet
 puphpet

apps/files/js/filelist.js

@@ -1327,14 +1327,20 @@
 			return OC.linkTo('files', 'index.php')+"?dir="+ encodeURIComponent(dir).replace(/%2F/g, '/');
 		},
 
+		/**
+		 * @param {string} path
+		 * @returns {boolean}
+		 */
 		_isValidPath: function(path) {
 			var sections = path.split('/');
 			for (var i = 0; i < sections.length; i++) {
 				if (sections[i] === '..') {
 					return false;
 				}
 			}
-			return true;
+
+			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 &&
+				path.toLowerCase().indexOf(decodeURI('%00')) === -1;
 		},
 
 		/**

apps/files/tests/js/filelistSpec.js

@@ -1333,9 +1333,11 @@ describe('OCA.Files.FileList tests', function() {
 				'/abc/..',
 				'/abc/../',
 				'/../abc/',
+				'/foo%0Abar/',
+				'/foo%00bar/',
 				'/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../'
 			], function(path) {
-				fileList.changeDirectory(path);
+				fileList.changeDirectory(decodeURI(path));
 				expect(fileList.getCurrentDirectory()).toEqual('/');
 			});
 		});