From e4543c5f35f9dd895508b197ee76834c537ff8ce Mon Sep 17 00:00:00 2001 From: KernelDeimos Date: Fri, 17 May 2024 12:32:16 -0400 Subject: [PATCH] Fix 8688ggu00 (2) --- packages/backend/src/util/pathutil.js | 9 +++++---- src/IPC.js | 3 ++- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/packages/backend/src/util/pathutil.js b/packages/backend/src/util/pathutil.js index 9069dc66..928db0bd 100644 --- a/packages/backend/src/util/pathutil.js +++ b/packages/backend/src/util/pathutil.js @@ -32,17 +32,18 @@ class PathBuilder extends AdvancedBase { } add (fragment, options) { + const require = this.require; + const node_path = require('path'); + options = options || {}; if ( ! options.allow_traversal ) { - fragment = fragment.replace(/(\.\.\/|\.\.\\)/g, ''); + fragment = node_path.normalize(fragment); + fragment = fragment.replace(/(\.+\/|\.+\\)/g, ''); if ( fragment === '..' ) { fragment = ''; } } - const require = this.require; - const node_path = require('path'); - this.path_ = this.path_ ? node_path.join(this.path_, fragment) : fragment; diff --git a/src/IPC.js b/src/IPC.js index 9f87909d..a04cba01 100644 --- a/src/IPC.js +++ b/src/IPC.js @@ -1016,7 +1016,8 @@ window.addEventListener('message', async (event) => { let create_missing_ancestors = false; console.warn(`The method ${event.data.msg} is deprecated - see docs.puter.com for more information.`); - event.data.filename = event.data.filename.replace(/(\.\.\/|\.\.\\)/g, ''); + event.data.filename = path.normalize(event.data.filename) + .replace(/(\.+\/|\.+\\)/g, ''); if(event.data.msg === 'saveToPictures') target_path = path.join(window.pictures_path, event.data.filename);