mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-07-19 11:33:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix ext.php: Restrict valid paths in ext.php for extensions (#7479)

Browse Source 
* Fix ext.php: Restrict valid paths in ext.php for extensions
Rework https://github.com/FreshRSS/FreshRSS/pull/7474

* Fix wrong variable
This commit is contained in:
Alexandre Alapetite
2025-04-01 19:13:27 +02:00
committed by GitHub
parent 89b0e1168e
commit d3aaefb1f6
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
p/ext.php
View File

@@ -78,10 +78,8 @@ function is_valid_path_extension(string $path, string $extensionPath, bool $isSt
* @return bool true if it can be served, false otherwise.
*/
function is_valid_path(string $path): bool {
return !str_contains($path, '..') && !str_starts_with($path, '/') && !str_starts_with($path, '\\') && (
is_valid_path_extension($path, CORE_EXTENSIONS_PATH) ||
is_valid_path_extension($path, THIRDPARTY_EXTENSIONS_PATH) ||
is_valid_path_extension($path, USERS_PATH, false));
return is_valid_path_extension($path, CORE_EXTENSIONS_PATH) || is_valid_path_extension($path, THIRDPARTY_EXTENSIONS_PATH)
|| is_valid_path_extension($path, USERS_PATH, false);
}
function sendBadRequestResponse(?string $message = null): never {
@@ -105,6 +103,11 @@ if (empty(SUPPORTED_TYPES[$file_type]) ||
sendBadRequestResponse('File type is not supported.');
}
// Forbid absolute paths and path traversal
if (str_contains($file_name, '..') || str_starts_with($file_name, '/') || str_starts_with($file_name, '\\')) {
sendBadRequestResponse('File is not supported.');
}
$absolute_filename = get_absolute_filename($file_name);
if (!is_valid_path($absolute_filename)) {
sendBadRequestResponse('File is not supported.');