浏览代码

Add another check for directory traversal

Use Path.GetFullPath to get the absolute path after translating
path separators and '.', '..' to ensure the path starts with the
expected base directory.
habeebweeb 4 年之前
父节点
当前提交
28f414817b
共有 1 个文件被更改,包括 2 次插入2 次删除
  1. 2 2
      COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

+ 2 - 2
COM3D2.MeidoPhotoStudio.Plugin/MeidoPhotoStudio/Constants.cs

@@ -126,7 +126,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.anm")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".anm";
+            fullPath = Path.GetFullPath($"{fullPath}.anm");
 
             if (!fullPath.StartsWith(Constants.customPosePath))
             {
@@ -173,7 +173,7 @@ namespace COM3D2.MeidoPhotoStudio.Plugin
 
             if (File.Exists($"{fullPath}.xml")) fullPath += $"_{DateTime.Now:yyyyMMddHHmmss}";
 
-            fullPath += ".xml";
+            fullPath = Path.GetFullPath($"{fullPath}.xml");
 
             if (!fullPath.StartsWith(Constants.customHandPath))
             {