Resolve attachments folder before using it

This commit is contained in:
Fedor Indutny 2022-04-26 17:31:01 -07:00 committed by GitHub
parent 50100906f3
commit b7f0ec61b9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 36 additions and 17 deletions

View file

@ -9,6 +9,15 @@ import type {
import { isAbsolute, normalize } from 'path';
import { existsSync, realpathSync } from 'fs';
import {
getAvatarsPath,
getBadgesPath,
getDraftPath,
getPath,
getStickersPath,
getTempPath,
getUpdateCachePath,
} from '../ts/util/attachments';
type CallbackType = (response: string | ProtocolResponse) => void;
@ -51,6 +60,17 @@ function _createFileHandler({
installPath: string;
isWindows: boolean;
}) {
const allowedRoots = [
userDataPath,
installPath,
getAvatarsPath(userDataPath),
getBadgesPath(userDataPath),
getDraftPath(userDataPath),
getPath(userDataPath),
getStickersPath(userDataPath),
getTempPath(userDataPath),
getUpdateCachePath(userDataPath),
];
return (request: ProtocolRequest, callback: CallbackType): void => {
let targetPath;
@ -95,24 +115,17 @@ function _createFileHandler({
return;
}
if (
!properCasing.startsWith(
isWindows ? userDataPath.toLowerCase() : userDataPath
) &&
!properCasing.startsWith(
isWindows ? installPath.toLowerCase() : installPath
)
) {
console.log(
`Warning: denying request to path '${realPath}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
);
callback({ error: -10 });
return;
for (const root of allowedRoots) {
if (properCasing.startsWith(isWindows ? root.toLowerCase() : root)) {
callback({ path: realPath });
return;
}
}
callback({
path: realPath,
});
console.log(
`Warning: denying request to path '${realPath}' (allowedRoots: '${allowedRoots}')`
);
callback({ error: -10 });
};
}

View file

@ -21,7 +21,13 @@ const createPathGetter =
if (!isString(userDataPath)) {
throw new TypeError("'userDataPath' must be a string");
}
return join(userDataPath, subpath);
const maybeSymlink = join(userDataPath, subpath);
if (fse.pathExistsSync(maybeSymlink)) {
return fse.realpathSync(maybeSymlink);
}
return maybeSymlink;
};
export const getAvatarsPath = createPathGetter(AVATAR_PATH);