diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | apps/files/js/filelist.js | 8 | ||||
| -rw-r--r-- | apps/files/tests/js/filelistSpec.js | 4 |
3 files changed, 11 insertions, 2 deletions
diff --git a/.gitignore b/.gitignore index 63a34beb978..0811a12f44b 100644 --- a/.gitignore +++ b/.gitignore @@ -107,6 +107,7 @@ nbproject /build/lib/ /build/jsdocs/ /npm-debug.log +/PhantomJS_* # puphpet puphpet diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js index ca41012764a..cfaeca1a06b 100644 --- a/apps/files/js/filelist.js +++ b/apps/files/js/filelist.js @@ -1407,6 +1407,10 @@ return OC.linkTo('files', 'index.php')+"?dir="+ encodeURIComponent(dir).replace(/%2F/g, '/'); }, + /** + * @param {string} path + * @returns {boolean} + */ _isValidPath: function(path) { var sections = path.split('/'); for (var i = 0; i < sections.length; i++) { @@ -1414,7 +1418,9 @@ return false; } } - return true; + + return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 && + path.toLowerCase().indexOf(decodeURI('%00')) === -1; }, /** diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js index 0a4812f3a81..304f8438a59 100644 --- a/apps/files/tests/js/filelistSpec.js +++ b/apps/files/tests/js/filelistSpec.js @@ -1401,9 +1401,11 @@ describe('OCA.Files.FileList tests', function() { '/abc/..', '/abc/../', '/../abc/', + '/foo%0Abar/', + '/foo%00bar/', '/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../' ], function(path) { - fileList.changeDirectory(path); + fileList.changeDirectory(decodeURI(path)); expect(fileList.getCurrentDirectory()).toEqual('/'); }); }); |