diff options
| author | Roeland Jago Douma <rullzer@users.noreply.github.com> | 2016-09-01 14:06:40 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-09-01 14:06:40 +0200 |
| commit | 8325c4443b64d10abc79f9b12ace093f69e8d4ce (patch) | |
| tree | 4fc4bd9c69fb3a5811e91e1a91a81132d39a7fef /apps | |
| parent | d3f82356bbbcfa6cc898e2a37a4908bf0f94dfe2 (diff) | |
| parent | 6c81c65eea4d77ab92d684894b2b48fc36528267 (diff) | |
| download | nextcloud-server-8325c4443b64d10abc79f9b12ace093f69e8d4ce.tar.gz nextcloud-server-8325c4443b64d10abc79f9b12ace093f69e8d4ce.zip | |
Merge pull request #1224 from nextcloud/do-not-allow-linebreak-in-paths
Do not allow linebreaks and null bytes in paths
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/files/js/filelist.js | 8 | ||||
| -rw-r--r-- | apps/files/tests/js/filelistSpec.js | 4 |
2 files changed, 10 insertions, 2 deletions
diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js index ca41012764a..cfaeca1a06b 100644 --- a/apps/files/js/filelist.js +++ b/apps/files/js/filelist.js @@ -1407,6 +1407,10 @@ return OC.linkTo('files', 'index.php')+"?dir="+ encodeURIComponent(dir).replace(/%2F/g, '/'); }, + /** + * @param {string} path + * @returns {boolean} + */ _isValidPath: function(path) { var sections = path.split('/'); for (var i = 0; i < sections.length; i++) { @@ -1414,7 +1418,9 @@ return false; } } - return true; + + return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 && + path.toLowerCase().indexOf(decodeURI('%00')) === -1; }, /** diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js index 0a4812f3a81..304f8438a59 100644 --- a/apps/files/tests/js/filelistSpec.js +++ b/apps/files/tests/js/filelistSpec.js @@ -1401,9 +1401,11 @@ describe('OCA.Files.FileList tests', function() { '/abc/..', '/abc/../', '/../abc/', + '/foo%0Abar/', + '/foo%00bar/', '/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../' ], function(path) { - fileList.changeDirectory(path); + fileList.changeDirectory(decodeURI(path)); expect(fileList.getCurrentDirectory()).toEqual('/'); }); }); |