Commits on Aug 8, 2018

1. Use file name whitelist to prevent RCE …

   Use a whitelist to validate user-provided file names. This doesn't cover
   the entire range of valid filenames but should cover almost all of them
   in practice. Allows letters, numbers, periods, dashes, and underscores.
   Opting to use a whitelist instead of a blacklist because getting this
   wrong leaves us vulnerable to a RCE attack.

   

   acdlite committed Aug 8, 2018
   Configuration menu

   • View commit details
   • Copy full SHA for 4165185
   • Browse repository at this point

   Copy the full SHA

   4165185 View commit details

   Browse the repository at this point in the history

2. Allow alphabet characters from all languages …

   Updated the whitelist to /^[\p{L}0-9/.\-_]+$/u, which matches
   alphanumeric characters, periods, dashes, and underscores. Unicode
   property support is stage 4 so I've inlined the transpiled version.

   

   acdlite committed Aug 8, 2018
   Configuration menu

   • View commit details
   • Copy full SHA for a5f27ce
   • Browse repository at this point

   Copy the full SHA

   a5f27ce View commit details

   Browse the repository at this point in the history

3. Only use file name whitelist on Windows

   

   acdlite committed Aug 8, 2018
   Configuration menu

   • View commit details
   • Copy full SHA for 7814826
   • Browse repository at this point

   Copy the full SHA

   7814826 View commit details

   Browse the repository at this point in the history

4. Log error message if file name does not pass whitelist

   

   acdlite committed Aug 8, 2018
   Configuration menu

   • View commit details
   • Copy full SHA for c1ef946
   • Browse repository at this point

   Copy the full SHA

   c1ef946 View commit details

   Browse the repository at this point in the history