mirrors/signal-desktop
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 2 Wiki Activity Actions

Follow symlinks on target file path as well as user/config paths

Browse source
This commit is contained in:
Scott Nonnenberg 2018-09-20 15:30:19 -07:00
parent 3464eb65b8
commit 48d937b66a
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
app/protocol_filter.js
View file

@ -1,4 +1,5 @@
const path = require('path');
const fs = require('fs');
function _eliminateAllAfterCharacter(string, character) {
const index = string.indexOf(character);
@ -24,21 +25,27 @@ function _createFileHandler({ userDataPath, installPath, isWindows }) {
return (request, callback) => {
// normalize() is primarily useful here for switching / to \ on windows
const target = path.normalize(_urlToPath(request.url, { isWindows }));
const realPath = fs.existsSync(target) ? fs.realpathSync(target) : target;
if (!path.isAbsolute(target)) {
console.log(`Warning: denying request to non-absolute path '${target}'`);
if (!path.isAbsolute(realPath)) {
console.log(
`Warning: denying request to non-absolute path '${realPath}'`
);
return callback();
}
if (!target.startsWith(userDataPath) && !target.startsWith(installPath)) {
if (
!realPath.startsWith(userDataPath) &&
!realPath.startsWith(installPath)
) {
console.log(
`Warning: denying request to path '${target}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
`Warning: denying request to path '${realPath}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
);
return callback();
}
return callback({
path: target,
path: realPath,
});
};
}