From: Lukas Reschke <lukas@owncloud.com>
Date: Thu, 26 Mar 2015 22:14:24 +0000 (+0100)
Subject: Filter potential dangerous characters in path name
X-Git-Tag: v8.1.0alpha1~143^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=9622fbdf292298458427ac6a33d65aba8f07b395;p=nextcloud-server.git

Filter potential dangerous characters in path name

We should not allow / or \ in the postfix here.
---

diff --git a/lib/private/tempmanager.php b/lib/private/tempmanager.php
index 197c0233142..5ab1427c505 100644
--- a/lib/private/tempmanager.php
+++ b/lib/private/tempmanager.php
@@ -54,10 +54,15 @@ class TempManager implements ITempManager {
 		$this->log = $logger;
 	}
 
+	/**
+	 * @param string $postFix
+	 * @return string
+	 */
 	protected function generatePath($postFix) {
 		if ($postFix) {
 			$postFix = '.' . ltrim($postFix, '.');
 		}
+		$postFix = str_replace(['\\', '/'], '', $postFix);
 		return $this->tmpBaseDir . '/oc_tmp_' . md5(time() . rand()) . $postFix;
 	}
 
diff --git a/tests/lib/tempmanager.php b/tests/lib/tempmanager.php
index 427e260c3fb..9bedd7c401b 100644
--- a/tests/lib/tempmanager.php
+++ b/tests/lib/tempmanager.php
@@ -151,4 +151,17 @@ class TempManager extends \Test\TestCase {
 			->with($this->stringContains('Can not create a temporary folder in directory'));
 		$this->assertFalse($manager->getTemporaryFolder());
 	}
+
+	public function testGeneratePathTraversal() {
+		$logger = $this->getMock('\Test\NullLogger');
+		$tmpManager = \Test_Helper::invokePrivate(
+			$this->getManager($logger),
+			'generatePath',
+			['../Traversal\\../FileName']
+		);
+
+		$this->assertStringEndsNotWith('./Traversal\\../FileName', $tmpManager);
+		$this->assertStringEndsWith('.Traversal..FileName', $tmpManager);
+
+	}
 }