فهرست منبع

Add another check for directory traversal

Use Path.GetFullPath to get the absolute path after translating
path separators and '.', '..' to ensure the path starts with the
expected base directory.
habeebweeb 4 سال پیش
والد
کامیت
28f414817b
1فایلهای تغییر یافته به همراه2 افزوده شده و 2 حذف شده
  1. 2 2
      COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

+ 2 - 2
COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

@@ -126,7 +126,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.anm")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".anm";
+            fullPath = Path.GetFullPath($"{fullPath}.anm");
 
             if (!fullPath.StartsWith(Constants.customPosePath))
             {
@@ -173,7 +173,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.xml")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".xml";
+            fullPath = Path.GetFullPath($"{fullPath}.xml");
 
             if (!fullPath.StartsWith(Constants.customHandPath))
             {