Administrator/NanoKVM-MIRROR
1
0
Fork 1
mirror of https://github.com/sipeed/NanoKVM.git synced 2026-09-11 09:26:44 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update service.go

Browse Source
This commit is contained in:
Alexander-Ger-Reich
2025-12-13 10:04:10 +01:00
committed by GitHub
parent 1fa6f48d4e
commit 116bb50364
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
server/service/download/service.go
View File

@@ -152,6 +152,22 @@ func (s *Service) DownloadImageFile(c *gin.Context) {
return
}
filename = filepath.Base(filename)
if filename != part.FileName() {
log.Warn("path detected in filename")
rsp.ErrRsp(c, -1, "invalid filename")
defer os.Remove(sentinelPath)
return
}
if strings.Contains(filename, "..") {
log.Warn("path traversal attempt")
rsp.ErrRsp(c, -1, "invalid filename")
defer os.Remove(sentinelPath)
return
}
data, err := os.ReadFile(sentinelPath)
if err != nil {
log.Error("Read failed")