mirrors/signal-desktop
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 2 Wiki Activity Actions

Follow symlinks on target file path as well as user/config paths

Browse source
This commit is contained in:
Scott Nonnenberg 2018-09-20 15:30:19 -07:00
parent 3464eb65b8
commit 48d937b66a
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
app/protocol_filter.js
View file

@ -1,4 +1,5 @@
const path = require('path'); const path = require('path');
const fs = require('fs');
function _eliminateAllAfterCharacter(string, character) { function _eliminateAllAfterCharacter(string, character) {
const index = string.indexOf(character); const index = string.indexOf(character);
@ -24,21 +25,27 @@ function _createFileHandler({ userDataPath, installPath, isWindows }) {
return (request, callback) => { return (request, callback) => {
// normalize() is primarily useful here for switching / to \ on windows // normalize() is primarily useful here for switching / to \ on windows
const target = path.normalize(_urlToPath(request.url, { isWindows })); const target = path.normalize(_urlToPath(request.url, { isWindows }));
const realPath = fs.existsSync(target) ? fs.realpathSync(target) : target;
if (!path.isAbsolute(target)) { if (!path.isAbsolute(realPath)) {
console.log(`Warning: denying request to non-absolute path '${target}'`); console.log(
`Warning: denying request to non-absolute path '${realPath}'`
);
return callback(); return callback();
} }
if (!target.startsWith(userDataPath) && !target.startsWith(installPath)) { if (
!realPath.startsWith(userDataPath) &&
!realPath.startsWith(installPath)
) {
console.log( console.log(
`Warning: denying request to path '${target}' (userDataPath: '${userDataPath}', installPath: '${installPath}')` `Warning: denying request to path '${realPath}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
); );
return callback(); return callback();
} }
return callback({ return callback({
path: target, path: realPath,
}); });
}; };
} }