Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use file name whitelist to prevent RCE #4866

Merged
merged 4 commits into from
Aug 22, 2018

Commits on Aug 8, 2018

  1. Use file name whitelist to prevent RCE

    Use a whitelist to validate user-provided file names. This doesn't cover
    the entire range of valid filenames but should cover almost all of them
    in practice. Allows letters, numbers, periods, dashes, and underscores.
    Opting to use a whitelist instead of a blacklist because getting this
    wrong leaves us vulnerable to a RCE attack.
    acdlite committed Aug 8, 2018
    Configuration menu
    Copy the full SHA
    4165185 View commit details
    Browse the repository at this point in the history
  2. Allow alphabet characters from all languages

    Updated the whitelist to /^[\p{L}0-9/.\-_]+$/u, which matches
    alphanumeric characters, periods, dashes, and underscores. Unicode
    property support is stage 4 so I've inlined the transpiled version.
    acdlite committed Aug 8, 2018
    Configuration menu
    Copy the full SHA
    a5f27ce View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    7814826 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    c1ef946 View commit details
    Browse the repository at this point in the history