Possible directory traversal in file upload #53

New Issue

2020-05-12T18:08:39+02:00

electricdusk commented

2020-05-12 18:08:39 +02:00

This occurred when building the Android app. During an upload attempts:

2020-05-12 18:02:24.659 26849-26986/com.dsprenkels.rushlinkshare E/com.dsprenkels.rushlinkshare.ShareActivity$Companion$UploadImageIntentHandler: Upload failed, unexpected code: Response{protocol=h2, code=500, message=, url=https://hashru.link/}
2020-05-12 18:02:24.663 26849-26986/com.dsprenkels.rushlinkshare I/com.dsprenkels.rushlinkshare.ShareActivity$Companion$UploadImageIntentHandler: Response body: internal server error: creating fileUpload: creating file dir: mkdir /var/lib/rushlink/filestore/08d7086ea08240bbaf3b57a5f1c25f31/data/user/0/com.dsprenkels.rushlinkshare/cache: no such file or directory

This is quite serious, because it probably also means that .. is not stripped from any paths.

This occurred when building the Android app. During an upload attempts: ``` 2020-05-12 18:02:24.659 26849-26986/com.dsprenkels.rushlinkshare E/com.dsprenkels.rushlinkshare.ShareActivity$Companion$UploadImageIntentHandler: Upload failed, unexpected code: Response{protocol=h2, code=500, message=, url=https://hashru.link/} 2020-05-12 18:02:24.663 26849-26986/com.dsprenkels.rushlinkshare I/com.dsprenkels.rushlinkshare.ShareActivity$Companion$UploadImageIntentHandler: Response body: internal server error: creating fileUpload: creating file dir: mkdir /var/lib/rushlink/filestore/08d7086ea08240bbaf3b57a5f1c25f31/data/user/0/com.dsprenkels.rushlinkshare/cache: no such file or directory ``` This is quite serious, because it probably also means that `..` is not stripped from any paths.

electricdusk added the bug needs-test labels 2020-05-12 18:08:39 +02:00

electricdusk self-assigned this 2020-05-12 18:08:39 +02:00

mrngm commented

2020-05-12 19:37:03 +02:00

Fix deployed out-of-band. Patch follows.

electricdusk referenced this issue from a commit

2020-05-12 20:03:04 +02:00

Prevent directory traversal in file upload Fixes #53

electricdusk closed this issue

2020-05-12 20:03:04 +02:00

Sign in to join this conversation.