External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): basename-sanitize file-preview paths (CodeQL js/path-injection)

Browse Source 
The resolve()+startsWith containment check was correct but CodeQL did not
recognize it. Apply path.basename() to the name in resolveWithinPreviewDir -- a
sanitizer CodeQL recognizes -- so every id-derived preview path is provably a
single filename inside the preview dir. Behaviour is unchanged for valid ids
(already charset-validated); containment check kept as a backstop.
This commit is contained in:
SnapOtter
2026-06-21 14:32:16 +08:00
parent bdadb843d8
commit 7a3b4e6b3b
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/file-preview.ts
+5 -2
View File
@@ -9,7 +9,7 @@ import { randomUUID } from "node:crypto";
import { createReadStream } from "node:fs"; import { createReadStream } from "node:fs";
import { access, copyFile, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises"; import { access, copyFile, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os"; import { tmpdir } from "node:os";
import { join, resolve, sep } from "node:path"; import { basename, join, resolve, sep } from "node:path";
import { convertDocument, sofficeAvailable } from "@snapotter/doc-engine"; import { convertDocument, sofficeAvailable } from "@snapotter/doc-engine";
import { runFfmpeg } from "@snapotter/media-engine"; import { runFfmpeg } from "@snapotter/media-engine";
import { eq } from "drizzle-orm"; import { eq } from "drizzle-orm";
@@ -39,8 +39,11 @@ async function ensurePreviewDir(): Promise<void> {
* check is the authoritative path-traversal barrier for every preview path. * check is the authoritative path-traversal barrier for every preview path.
*/ */
function resolveWithinPreviewDir(name: string): string { function resolveWithinPreviewDir(name: string): string {
// basename() strips any directory component, so the result can only ever be a
// single filename inside the preview dir; the containment check is a
// defense-in-depth backstop.
const base = resolve(previewDirPath()); const base = resolve(previewDirPath());
const resolved = resolve(base, name); const resolved = join(base, basename(name));
if (resolved !== base && !resolved.startsWith(base + sep)) { if (resolved !== base && !resolved.startsWith(base + sep)) {
throw new Error("Preview path escapes the preview directory"); throw new Error("Preview path escapes the preview directory");
} }