From 5b65591d84a0dafb9415539eef75424004f6a4f6 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Fri, 1 Jul 2016 13:33:00 +0200 Subject: Do not allow directory traversal using "../" We should not allow directory traversals using "../" here. To test access the following URL once with and then without this patch: http://localhost/server/index.php/apps/files/?dir=../../This+Should+Not+Be+Here --- apps/files/js/filelist.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'apps/files/js/filelist.js') diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js index e483882fcc5..1f19c2a6258 100644 --- a/apps/files/js/filelist.js +++ b/apps/files/js/filelist.js @@ -1404,7 +1404,7 @@ * @param {string} [fileId] file id */ _setCurrentDir: function(targetDir, changeUrl, fileId) { - targetDir = targetDir.replace(/\\/g, '/'); + targetDir = targetDir.replace(/\\/g, '/').replace(/\.\.\//g, ''); var previousDir = this.getCurrentDirectory(), baseDir = OC.basename(targetDir); -- cgit v1.2.3 From 4ac9eaab0379cc0535a6ab18be0fa147facf1bd5 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Fri, 1 Jul 2016 15:00:31 +0200 Subject: Match for /../ --- apps/files/js/filelist.js | 2 +- apps/files/tests/js/filelistSpec.js | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) (limited to 'apps/files/js/filelist.js') diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js index 1f19c2a6258..506d423c817 100644 --- a/apps/files/js/filelist.js +++ b/apps/files/js/filelist.js @@ -1404,7 +1404,7 @@ * @param {string} [fileId] file id */ _setCurrentDir: function(targetDir, changeUrl, fileId) { - targetDir = targetDir.replace(/\\/g, '/').replace(/\.\.\//g, ''); + targetDir = targetDir.replace(/\\/g, '/').replace(/\/\.\.\//g, '/'); var previousDir = this.getCurrentDirectory(), baseDir = OC.basename(targetDir); diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js index baf071af9bd..a9b6a1ac1c8 100644 --- a/apps/files/tests/js/filelistSpec.js +++ b/apps/files/tests/js/filelistSpec.js @@ -1338,6 +1338,10 @@ describe('OCA.Files.FileList tests', function() { fileList.changeDirectory('/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../'); expect(fileList.getCurrentDirectory()).toEqual('/another/subdir/foo/bar/file/folder/'); }); + it('does not convert folders with a ".." in the name', function() { + fileList.changeDirectory('/abc../def'); + expect(fileList.getCurrentDirectory()).toEqual('/abc../def'); + }); it('switches to root dir when current directory does not exist', function() { fileList.changeDirectory('/unexist'); deferredList.reject(404); -- cgit v1.2.3 From 76c73d5ec32828d9b5d546aefd489b8080b8bad5 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Fri, 1 Jul 2016 15:19:08 +0200 Subject: Match on 405 --- apps/files/js/filelist.js | 2 +- apps/files/tests/js/filelistSpec.js | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) (limited to 'apps/files/js/filelist.js') diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js index 506d423c817..0813d2cc30e 100644 --- a/apps/files/js/filelist.js +++ b/apps/files/js/filelist.js @@ -1552,7 +1552,7 @@ return false; } - if (status === 404) { + if (status === 404 || status === 405) { // go back home this.changeDirectory('/'); return false; diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js index a9b6a1ac1c8..453f1cafcaf 100644 --- a/apps/files/tests/js/filelistSpec.js +++ b/apps/files/tests/js/filelistSpec.js @@ -1347,6 +1347,11 @@ describe('OCA.Files.FileList tests', function() { deferredList.reject(404); expect(fileList.getCurrentDirectory()).toEqual('/'); }); + it('switches to root dir when current directory returns 405', function() { + fileList.changeDirectory('/unexist'); + deferredList.reject(405); + expect(fileList.getCurrentDirectory()).toEqual('/'); + }); it('switches to root dir when current directory is forbidden', function() { fileList.changeDirectory('/unexist'); deferredList.reject(403); -- cgit v1.2.3