Merge pull request #17879 from owncloud/scan-check-path

check if the user is trying to scan a valid path

2 files changed, 31 insertions, 0 deletions

diff --git a/lib/private/files/utils/scanner.php b/lib/private/files/utils/scanner.php
index 3d68eb530a2..c70f4beb31d 100644
--- a/lib/private/files/utils/scanner.php
+++ b/lib/private/files/utils/scanner.php
@@ -131,6 +131,9 @@ class Scanner extends PublicEmitter {
 	 * @throws \OC\ForbiddenException
 	 */
 	public function scan($dir = '') {
+		if (!Filesystem::isValidPath($dir)) {
+			throw new \InvalidArgumentException('Invalid path to scan');
+		}
 		$mounts = $this->getMounts($dir);
 		foreach ($mounts as $mount) {
 			if (is_null($mount->getStorage())) {
diff --git a/tests/lib/files/utils/scanner.php b/tests/lib/files/utils/scanner.php
index ca64b1db72e..75cd75ee3f5 100644
--- a/tests/lib/files/utils/scanner.php
+++ b/tests/lib/files/utils/scanner.php
@@ -189,4 +189,32 @@ class Scanner extends \Test\TestCase {
 		$newInfo = $cache->get('');
 		$this->assertNotEquals($oldInfo['etag'], $newInfo['etag']);
 	}
+
+	/**
+	 * @return array
+	 */
+	public function invalidPathProvider() {
+		return [
+			[
+				'../',
+			],
+			[
+				'..\\',
+			],
+			[
+				'../..\\../',
+			],
+		];
+	}
+
+	/**
+	 * @dataProvider invalidPathProvider
+	 * @expectedException \InvalidArgumentException
+	 * @expectedExceptionMessage Invalid path to scan
+	 * @param string $invalidPath
+	 */
+	public function testInvalidPathScanning($invalidPath) {
+		$scanner = new TestScanner('', \OC::$server->getDatabaseConnection());
+		$scanner->scan($invalidPath);
+	}
 }