diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2021-09-07 08:31:16 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-09-07 08:31:16 +0200 |
| commit | d4d1f5dfce49e079feb0b6a826f007b0c99ab16f (patch) | |
| tree | 51f9c36d60b93d1c278b22d41914fda2d2b0187d | |
| parent | 3ead5986470409433419d8f9d80616b9669e10db (diff) | |
| parent | 19ad636373e665f636c31fea7b2dc6003bbc27ab (diff) | |
| download | nextcloud-server-d4d1f5dfce49e079feb0b6a826f007b0c99ab16f.tar.gz nextcloud-server-d4d1f5dfce49e079feb0b6a826f007b0c99ab16f.zip | |
Merge pull request #28726 from nextcloud/check-if-path-is-valid
Check if SVG path is valid
| -rw-r--r-- | core/Controller/SvgController.php | 5 | ||||
| -rw-r--r-- | tests/Core/Controller/SvgControllerTest.php | 2 |
2 files changed, 6 insertions, 1 deletions
diff --git a/core/Controller/SvgController.php b/core/Controller/SvgController.php index ea73ba118d9..17f16dd48e6 100644 --- a/core/Controller/SvgController.php +++ b/core/Controller/SvgController.php @@ -31,6 +31,7 @@ declare(strict_types=1); */ namespace OC\Core\Controller; +use OC\Files\Filesystem; use OC\Template\IconsCacher; use OCP\App\AppPathNotFoundException; use OCP\App\IAppManager; @@ -117,6 +118,10 @@ class SvgController extends Controller { * @return DataDisplayResponse|NotFoundResponse */ private function getSvg(string $path, string $color, string $fileName) { + if (!Filesystem::isValidPath($path)) { + return new NotFoundResponse(); + } + if (!file_exists($path)) { return new NotFoundResponse(); } diff --git a/tests/Core/Controller/SvgControllerTest.php b/tests/Core/Controller/SvgControllerTest.php index c8d0ea5f503..f44440389ff 100644 --- a/tests/Core/Controller/SvgControllerTest.php +++ b/tests/Core/Controller/SvgControllerTest.php @@ -183,7 +183,7 @@ class SvgControllerTest extends TestCase { $this->appManager->expects($this->once()) ->method('getAppPath') ->with($appName) - ->willReturn(__DIR__ . '/../../../apps/' . $appName); + ->willReturn(realpath(__DIR__ . '/../../../apps/') . '/' . $appName); $response = $this->svgController->getSvgFromApp($appName, $name, $color); |