From 2be9d5c13492cf88698da5b1616210bef9996a28 Mon Sep 17 00:00:00 2001 From: Rob Emery Date: Sat, 11 Jan 2025 17:38:05 +0000 Subject: [PATCH] Tightening up the .. and . protection a smidge --- dlna/contenddirectoryservice.go | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/dlna/contenddirectoryservice.go b/dlna/contenddirectoryservice.go index 8d3c2c509..8072880c6 100644 --- a/dlna/contenddirectoryservice.go +++ b/dlna/contenddirectoryservice.go @@ -10,6 +10,7 @@ import ( "os" "path" "path/filepath" + "slices" "strings" "time" @@ -194,13 +195,11 @@ func (cds *contentDirectoryService) readContainer(o object, host string) (ret [] } func (cds *contentDirectoryService) doFiles(ret []interface{}, oPath string, host string) ([]interface{}, error) { - pathUnderFiles := strings.TrimPrefix(oPath, "/Music/Files") - //TODO make not terrible - if(strings.Contains(pathUnderFiles, "/..")) { + pathComponents := strings.Split(strings.TrimPrefix(oPath, "/Music/Files"), "/") + if(slices.Contains(pathComponents, "..") || slices.Contains(pathComponents, ".")) { + log.Error("Attempt to use .. or . detected", oPath, host) return ret, nil } - - pathComponents := strings.Split(pathUnderFiles, "/") totalPathArrayBits := append([]string{conf.Server.MusicFolder}, pathComponents...) localFilePath := filepath.Join(totalPathArrayBits...)