Kaynağa Gözat

Add another check for directory traversal

Use Path.GetFullPath to get the absolute path after translating
path separators and '.', '..' to ensure the path starts with the
expected base directory.
habeebweeb 4 yıl önce
ebeveyn
işleme
28f414817b

+ 2 - 2
COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

@@ -126,7 +126,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.anm")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".anm";
+            fullPath = Path.GetFullPath($"{fullPath}.anm");
 
             if (!fullPath.StartsWith(Constants.customPosePath))
             {
@@ -173,7 +173,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.xml")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".xml";
+            fullPath = Path.GetFullPath($"{fullPath}.xml");
 
             if (!fullPath.StartsWith(Constants.customHandPath))
             {