github_mirrors/puter
1
0
Fork 0
mirror of https://github.com/HeyPuter/puter.git synced 2025-01-24 06:50:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix 8688ggu00 (2)

Browse Source
This commit is contained in:
KernelDeimos 2024-05-17 12:32:16 -04:00
parent c55b1e4680
commit e4543c5f35
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
packages/backend/src/util/pathutil.js
View File

@ -32,17 +32,18 @@ class PathBuilder extends AdvancedBase {
} }
add (fragment, options) { add (fragment, options) {
const require = this.require;
const node_path = require('path');
options = options || {}; options = options || {};
if ( ! options.allow_traversal ) { if ( ! options.allow_traversal ) {
fragment = fragment.replace(/(\.\.\/|\.\.\\)/g, ''); fragment = node_path.normalize(fragment);
fragment = fragment.replace(/(\.+\/|\.+\\)/g, '');
if ( fragment === '..' ) { if ( fragment === '..' ) {
fragment = ''; fragment = '';
} }
} }
const require = this.require;
const node_path = require('path');
this.path_ = this.path_ this.path_ = this.path_
? node_path.join(this.path_, fragment) ? node_path.join(this.path_, fragment)
: fragment; : fragment;

3
src/IPC.js
View File

@ -1016,7 +1016,8 @@ window.addEventListener('message', async (event) => {
let create_missing_ancestors = false; let create_missing_ancestors = false;
console.warn(`The method ${event.data.msg} is deprecated - see docs.puter.com for more information.`); console.warn(`The method ${event.data.msg} is deprecated - see docs.puter.com for more information.`);
event.data.filename = event.data.filename.replace(/(\.\.\/|\.\.\\)/g, ''); event.data.filename = path.normalize(event.data.filename)
.replace(/(\.+\/|\.+\\)/g, '');
if(event.data.msg === 'saveToPictures') if(event.data.msg === 'saveToPictures')
target_path = path.join(window.pictures_path, event.data.filename); target_path = path.join(window.pictures_path, event.data.filename);