Explorar el Código

Add another check for directory traversal

Use Path.GetFullPath to get the absolute path after translating
path separators and '.', '..' to ensure the path starts with the
expected base directory.
habeebweeb hace 4 años
padre
commit
28f414817b
Se han modificado 1 ficheros con 2 adiciones y 2 borrados
  1. 2 2
      COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

+ 2 - 2
COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

@@ -126,7 +126,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.anm")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".anm";
+            fullPath = Path.GetFullPath($"{fullPath}.anm");
 
             if (!fullPath.StartsWith(Constants.customPosePath))
             {
@@ -173,7 +173,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.xml")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".xml";
+            fullPath = Path.GetFullPath($"{fullPath}.xml");
 
             if (!fullPath.StartsWith(Constants.customHandPath))
             {