From 4a02a783c43fef86a5345770e109830e23b68111 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Fri, 21 Dec 2018 10:32:11 +0800 Subject: [PATCH] fix bug on upload file name (#5571) --- routers/repo/editor.go | 19 ++++++++++++++++++- routers/repo/editor_test.go | 30 ++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 routers/repo/editor_test.go diff --git a/routers/repo/editor.go b/routers/repo/editor.go index d36bcc4c36..f64b0002ae 100644 --- a/routers/repo/editor.go +++ b/routers/repo/editor.go @@ -559,6 +559,17 @@ func UploadFilePost(ctx *context.Context, form auth.UploadRepoFileForm) { ctx.Redirect(ctx.Repo.RepoLink + "/src/branch/" + branchName + "/" + form.TreePath) } +func cleanUploadFileName(name string) string { + name = strings.TrimLeft(name, "./\\") + name = strings.Replace(name, "../", "", -1) + name = strings.Replace(name, "..\\", "", -1) + name = strings.TrimPrefix(path.Clean(name), ".git/") + if name == ".git" { + return "" + } + return name +} + // UploadFileToServer upload file to server file dir not git func UploadFileToServer(ctx *context.Context) { file, header, err := ctx.Req.FormFile("file") @@ -591,7 +602,13 @@ func UploadFileToServer(ctx *context.Context) { } } - upload, err := models.NewUpload(header.Filename, buf, file) + name := cleanUploadFileName(header.Filename) + if len(name) == 0 { + ctx.Error(500, "Upload file name is invalid") + return + } + + upload, err := models.NewUpload(name, buf, file) if err != nil { ctx.Error(500, fmt.Sprintf("NewUpload: %v", err)) return diff --git a/routers/repo/editor_test.go b/routers/repo/editor_test.go new file mode 100644 index 0000000000..e5b9570205 --- /dev/null +++ b/routers/repo/editor_test.go @@ -0,0 +1,30 @@ +// Copyright 2018 The Gitea Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package repo + +import ( + "testing" + + "code.gitea.io/gitea/models" + "github.com/stretchr/testify/assert" +) + +func TestCleanUploadName(t *testing.T) { + models.PrepareTestEnv(t) + + var kases = map[string]string{ + ".git/refs/master": "git/refs/master", + "/root/abc": "root/abc", + "./../../abc": "abc", + "a/../.git": "a/.git", + "a/../../../abc": "a/abc", + "../../../acd": "acd", + "../../.git/abc": "git/abc", + "..\\..\\.git/abc": "git/abc", + } + for k, v := range kases { + assert.EqualValues(t, v, cleanUploadFileName(k)) + } +}