diff options
| -rw-r--r-- | lib/private/files/utils/scanner.php | 3 | ||||
| -rw-r--r-- | tests/lib/files/utils/scanner.php | 28 |
2 files changed, 31 insertions, 0 deletions
diff --git a/lib/private/files/utils/scanner.php b/lib/private/files/utils/scanner.php index 3d68eb530a2..c70f4beb31d 100644 --- a/lib/private/files/utils/scanner.php +++ b/lib/private/files/utils/scanner.php @@ -131,6 +131,9 @@ class Scanner extends PublicEmitter { * @throws \OC\ForbiddenException */ public function scan($dir = '') { + if (!Filesystem::isValidPath($dir)) { + throw new \InvalidArgumentException('Invalid path to scan'); + } $mounts = $this->getMounts($dir); foreach ($mounts as $mount) { if (is_null($mount->getStorage())) { diff --git a/tests/lib/files/utils/scanner.php b/tests/lib/files/utils/scanner.php index ca64b1db72e..75cd75ee3f5 100644 --- a/tests/lib/files/utils/scanner.php +++ b/tests/lib/files/utils/scanner.php @@ -189,4 +189,32 @@ class Scanner extends \Test\TestCase { $newInfo = $cache->get(''); $this->assertNotEquals($oldInfo['etag'], $newInfo['etag']); } + + /** + * @return array + */ + public function invalidPathProvider() { + return [ + [ + '../', + ], + [ + '..\\', + ], + [ + '../..\\../', + ], + ]; + } + + /** + * @dataProvider invalidPathProvider + * @expectedException \InvalidArgumentException + * @expectedExceptionMessage Invalid path to scan + * @param string $invalidPath + */ + public function testInvalidPathScanning($invalidPath) { + $scanner = new TestScanner('', \OC::$server->getDatabaseConnection()); + $scanner->scan($invalidPath); + } } |