Merge pull request #28757 from nextcloud/backport/28726/stable19

[stable19] Check if SVG path is valid
nextcloud · Sep 8, 2021 · 37481f4 · 37481f4
2 parents 7f88016 + 4efd8fa
commit 37481f4
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/core/Controller/SvgController.php b/core/Controller/SvgController.php
@@ -31,6 +31,7 @@
 
 namespace OC\Core\Controller;
 
+use OC\Files\Filesystem;
 use OC\Template\IconsCacher;
 use OCP\App\AppPathNotFoundException;
 use OCP\App\IAppManager;
@@ -117,6 +118,10 @@ public function getSvgFromApp(string $app, string $fileName, string $color = 'ff
 	 * @return DataDisplayResponse|NotFoundResponse
 	 */
 	private function getSvg(string $path, string $color, string $fileName) {
+		if (!Filesystem::isValidPath($path)) {
+			return new NotFoundResponse();
+		}
+
 		if (!file_exists($path)) {
 			return new NotFoundResponse();
 		}

diff --git a/tests/Core/Controller/SvgControllerTest.php b/tests/Core/Controller/SvgControllerTest.php
@@ -183,7 +183,7 @@ public function testGetSvgFromApp(string $appName, string $name, string $color,
 		$this->appManager->expects($this->once())
 			->method('getAppPath')
 			->with($appName)
-			->willReturn(__DIR__ . '/../../../apps/' . $appName);
+			->willReturn(realpath(__DIR__ . '/../../../apps/') . '/' . $appName);
 
 		$response = $this->svgController->getSvgFromApp($appName, $name, $color);