Bläddra i källkod

Add another check for directory traversal

Use Path.GetFullPath to get the absolute path after translating
path separators and '.', '..' to ensure the path starts with the
expected base directory.
habeebweeb 4 år sedan
förälder
incheckning
28f414817b
1 ändrade filer med 2 tillägg och 2 borttagningar
  1. 2 2
      COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

+ 2 - 2
COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

@@ -126,7 +126,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.anm")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".anm";
+            fullPath = Path.GetFullPath($"{fullPath}.anm");
 
             if (!fullPath.StartsWith(Constants.customPosePath))
             {
@@ -173,7 +173,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.xml")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".xml";
+            fullPath = Path.GetFullPath($"{fullPath}.xml");
 
             if (!fullPath.StartsWith(Constants.customHandPath))
             {