mirrors/signal-desktop
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 2 Wiki Activity Actions

Windows: Do our file filtration with case-insensitive checks

Browse source
This commit is contained in:
Scott Nonnenberg 2019-04-10 12:17:40 -07:00
parent 62de2a229d
commit be86169a8a
1 changed files with 14 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
app/protocol_filter.js
View file

@ -25,27 +25,35 @@ function _createFileHandler({ userDataPath, installPath, isWindows }) {
return (request, callback) => {
// normalize() is primarily useful here for switching / to \ on windows
const target = path.normalize(_urlToPath(request.url, { isWindows }));
// here we attempt to follow symlinks to the ultimate final path, reflective of what
// we do in main.js on userDataPath and installPath
const realPath = fs.existsSync(target) ? fs.realpathSync(target) : target;
// finally we do case-insensitive checks on windows
const properCasing = isWindows ? realPath.toLowerCase() : realPath;
if (!path.isAbsolute(realPath)) {
if (!path.isAbsolute(properCasing)) {
console.log(
`Warning: denying request to non-absolute path '${realPath}'`
`Warning: denying request to non-absolute path '${properCasing}'`
);
return callback();
}
if (
!realPath.startsWith(userDataPath) &&
!realPath.startsWith(installPath)
!properCasing.startsWith(
isWindows ? userDataPath.toLowerCase() : userDataPath
) &&
!properCasing.startsWith(
isWindows ? installPath.toLowerCase() : installPath
)
) {
console.log(
`Warning: denying request to path '${realPath}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
`Warning: denying request to path '${properCasing}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
);
return callback();
}
return callback({
path: realPath,
path: properCasing,
});
};
}