Skip to content
Permalink
Browse files

Do not allow directory traversal using "../"

We should not allow directory traversals using "../" here.

To test access the following URL once with and then without this patch:

http://localhost/server/index.php/apps/files/?dir=../../This+Should+Not+Be+Here
  • Loading branch information...
LukasReschke committed Jul 1, 2016
1 parent 23cc465 commit 2da43e3751576bbc838f238a09955c4dcdebee8e
Showing with 5 additions and 1 deletion.
  1. +1 −1 apps/files/js/filelist.js
  2. +4 −0 apps/files/tests/js/filelistSpec.js
@@ -1333,7 +1333,7 @@
* @param changeUrl true to also update the URL, false otherwise (default)
*/
_setCurrentDir: function(targetDir, changeUrl) {
targetDir = targetDir.replace(/\\/g, '/');
targetDir = targetDir.replace(/\\/g, '/').replace(/\.\.\//g, '');
var previousDir = this.getCurrentDirectory(),
baseDir = OC.basename(targetDir);

@@ -1323,6 +1323,10 @@ describe('OCA.Files.FileList tests', function() {
fileList.changeDirectory('/another\\subdir');
expect(fileList.getCurrentDirectory()).toEqual('/another/subdir');
});
it('converts backslashes to slashes and removes traversals when calling changeDirectory()', function() {
fileList.changeDirectory('/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../');
expect(fileList.getCurrentDirectory()).toEqual('/another/subdir/foo/bar/file/folder/');
});
it('switches to root dir when current directory does not exist', function() {
fileList.changeDirectory('/unexist');
deferredList.reject(404);

0 comments on commit 2da43e3

Please sign in to comment.
You can’t perform that action at this time.