mirrors/signal-desktop
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 2 Wiki Activity Actions

Hardening: normalize on-disk attachment paths before save/load

Browse source
This commit is contained in:
Scott Nonnenberg 2018-05-18 18:08:22 -07:00
parent b8dedd18eb
commit 06b0544bbe
2 changed files with 108 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

29
app/attachments.js
View file

@ -37,7 +37,11 @@ exports.createReader = root => {
}
const absolutePath = path.join(root, relativePath);
const buffer = await fse.readFile(absolutePath);
const normalized = path.normalize(absolutePath);
if (!normalized.startsWith(root)) {
throw new Error('Invalid relative path');
}
const buffer = await fse.readFile(normalized);
return toArrayBuffer(buffer);
};
};
@ -83,8 +87,13 @@ exports.createWriterForExisting = root => {
const buffer = Buffer.from(arrayBuffer);
const absolutePath = path.join(root, relativePath);
await fse.ensureFile(absolutePath);
await fse.writeFile(absolutePath, buffer);
const normalized = path.normalize(absolutePath);
if (!normalized.startsWith(root)) {
throw new Error('Invalid relative path');
}
await fse.ensureFile(normalized);
await fse.writeFile(normalized, buffer);
return relativePath;
};
};
@ -103,6 +112,10 @@ exports.createDeleter = root => {
}
const absolutePath = path.join(root, relativePath);
const normalized = path.normalize(absolutePath);
if (!normalized.startsWith(root)) {
throw new Error('Invalid relative path');
}
await fse.remove(absolutePath);
};
};
@ -124,5 +137,11 @@ exports.getRelativePath = name => {
};
// createAbsolutePathGetter :: RoothPath -> RelativePath -> AbsolutePath
exports.createAbsolutePathGetter = rootPath => relativePath =>
path.join(rootPath, relativePath);
exports.createAbsolutePathGetter = rootPath => relativePath => {
const absolutePath = path.join(rootPath, relativePath);
const normalized = path.normalize(absolutePath);
if (!normalized.startsWith(rootPath)) {
throw new Error('Invalid relative path');
}
return normalized;
};