nicoeri/filebrowser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prevent maliciously constructed parameters like /api/public/dl/XZzCDnK2_not_exists_hash_name cause panic

Browse Source 
this bug was introduced in https://github.com/filebrowser/filebrowser/pull/727
This commit is contained in:
荒野無燈 2019-06-23 22:40:59 +08:00
parent fc5e2247f6
commit 14f94e0cfc
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
http/public.go
View File

@ -40,8 +40,15 @@ var withHashFile = func(fn handleFunc) handleFunc {
}
}
// ref to https://github.com/filebrowser/filebrowser/pull/727
// `/api/public/dl/MEEuZK-v/file-name.txt` for old browsers to save file with correct name
func ifPathWithName(r *http.Request) string {
pathElements := strings.Split(r.URL.Path, "/")
// prevent maliciously constructed parameters like `/api/public/dl/XZzCDnK2_not_exists_hash_name`
// len(pathElements) will be 1, and golang will panic `runtime error: index out of range`
if len(pathElements) < 2 {
return r.URL.Path
}
id := pathElements[len(pathElements)-2]
return id
}