From fd1e8563f8713265df2e402e9387e0964efc42e2 Mon Sep 17 00:00:00 2001 From: zeripath Date: Fri, 4 Jan 2019 16:08:26 +0000 Subject: [PATCH] SECURITY: protect DeleteFilePost et al with cleanUploadFileName (#5631) This commit wraps more of the TreePaths with cleanUploadFileName Signed-off-by: Andrew Thornton --- routers/repo/editor.go | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/routers/repo/editor.go b/routers/repo/editor.go index f64b0002ae..4e3557dbb2 100644 --- a/routers/repo/editor.go +++ b/routers/repo/editor.go @@ -163,7 +163,11 @@ func editFilePost(ctx *context.Context, form auth.EditRepoFileForm, isNewFile bo branchName = form.NewBranchName } - form.TreePath = strings.Trim(path.Clean("/"+form.TreePath), " /") + form.TreePath = cleanUploadFileName(form.TreePath) + if len(form.TreePath) == 0 { + ctx.Error(500, "Upload file name is invalid") + return + } treeNames, treePaths := getParentTreeFields(form.TreePath) ctx.Data["TreePath"] = form.TreePath @@ -373,6 +377,13 @@ func DeleteFile(ctx *context.Context) { func DeleteFilePost(ctx *context.Context, form auth.DeleteRepoFileForm) { ctx.Data["PageIsDelete"] = true ctx.Data["BranchLink"] = ctx.Repo.RepoLink + "/src/" + ctx.Repo.BranchNameSubURL() + + ctx.Repo.TreePath = cleanUploadFileName(ctx.Repo.TreePath) + if len(ctx.Repo.TreePath) == 0 { + ctx.Error(500, "Delete file name is invalid") + return + } + ctx.Data["TreePath"] = ctx.Repo.TreePath canCommit := renderCommitRights(ctx) @@ -477,7 +488,12 @@ func UploadFilePost(ctx *context.Context, form auth.UploadRepoFileForm) { branchName = form.NewBranchName } - form.TreePath = strings.Trim(path.Clean("/"+form.TreePath), " /") + form.TreePath = cleanUploadFileName(form.TreePath) + if len(form.TreePath) == 0 { + ctx.Error(500, "Upload file name is invalid") + return + } + treeNames, treePaths := getParentTreeFields(form.TreePath) if len(treeNames) == 0 { // We must at least have one element for user to input.