Skip to content

Commit b5bf5f4

Browse files
xhofexhofe
committed
fix: check if the req path is relative path (close #2531)
1 parent f9788ea commit b5bf5f4

File tree

8 files changed

+172
-68
lines changed

8 files changed

+172
-68
lines changed

‎internal/model/user.go

+5
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package model
22

33
import (
44
"github.com/alist-org/alist/v3/internal/errs"
5+
"github.com/alist-org/alist/v3/pkg/utils"
56
"github.com/pkg/errors"
67
)
78

@@ -89,3 +90,7 @@ func (u User) CanWebdavRead() bool {
8990
func (u User) CanWebdavManage() bool {
9091
return u.IsAdmin() || (u.Permission>>9)&1 == 1
9192
}
93+
94+
func (u User) JoinPath(reqPath string) (string, error) {
95+
return utils.JoinBasePath(u.BasePath, reqPath)
96+
}

‎pkg/utils/path.go

+9
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ import (
66
"path/filepath"
77
"runtime"
88
"strings"
9+
10+
"github.com/alist-org/alist/v3/internal/errs"
911
)
1012

1113
// StandardizePath convert path like '/' '/root' '/a/b'
@@ -60,3 +62,10 @@ func EncodePath(path string, all ...bool) string {
6062
}
6163
return strings.Join(seg, "/")
6264
}
65+
66+
func JoinBasePath(basePath, reqPath string) (string, error) {
67+
if strings.HasSuffix(reqPath, "..") || strings.Contains(reqPath, "../") {
68+
return "", errs.RelativePath
69+
}
70+
return stdpath.Join(basePath, reqPath), nil
71+
}

‎server/handles/aria2.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
package handles
22

33
import (
4-
stdpath "path"
5-
64
"github.com/alist-org/alist/v3/internal/aria2"
75
"github.com/alist-org/alist/v3/internal/conf"
86
"github.com/alist-org/alist/v3/internal/db"
@@ -58,9 +56,13 @@ func AddAria2(c *gin.Context) {
5856
common.ErrorResp(c, err, 400)
5957
return
6058
}
61-
req.Path = stdpath.Join(user.BasePath, req.Path)
59+
reqPath, err := user.JoinPath(req.Path)
60+
if err != nil {
61+
common.ErrorResp(c, err, 403)
62+
return
63+
}
6264
for _, url := range req.Urls {
63-
err := aria2.AddURI(c, url, req.Path)
65+
err := aria2.AddURI(c, url, reqPath)
6466
if err != nil {
6567
common.ErrorResp(c, err, 500)
6668
return

‎server/handles/fsmanage.go

+51-21
Original file line numberDiff line numberDiff line change
@@ -26,25 +26,29 @@ func FsMkdir(c *gin.Context) {
2626
return
2727
}
2828
user := c.MustGet("user").(*model.User)
29-
req.Path = stdpath.Join(user.BasePath, req.Path)
29+
reqPath, err := user.JoinPath(req.Path)
30+
if err != nil {
31+
common.ErrorResp(c, err, 403)
32+
return
33+
}
3034
if !user.CanWrite() {
31-
meta, err := db.GetNearestMeta(stdpath.Dir(req.Path))
35+
meta, err := db.GetNearestMeta(stdpath.Dir(reqPath))
3236
if err != nil {
3337
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
3438
common.ErrorResp(c, err, 500, true)
3539
return
3640
}
3741
}
38-
if !common.CanWrite(meta, req.Path) {
42+
if !common.CanWrite(meta, reqPath) {
3943
common.ErrorResp(c, errs.PermissionDenied, 403)
4044
return
4145
}
4246
}
43-
if err := fs.MakeDir(c, req.Path); err != nil {
47+
if err := fs.MakeDir(c, reqPath); err != nil {
4448
common.ErrorResp(c, err, 500)
4549
return
4650
}
47-
fs.ClearCache(stdpath.Dir(req.Path))
51+
fs.ClearCache(stdpath.Dir(reqPath))
4852
common.SuccessResp(c)
4953
}
5054

@@ -69,17 +73,25 @@ func FsMove(c *gin.Context) {
6973
common.ErrorResp(c, errs.PermissionDenied, 403)
7074
return
7175
}
72-
req.SrcDir = stdpath.Join(user.BasePath, req.SrcDir)
73-
req.DstDir = stdpath.Join(user.BasePath, req.DstDir)
76+
srcDir, err := user.JoinPath(req.SrcDir)
77+
if err != nil {
78+
common.ErrorResp(c, err, 403)
79+
return
80+
}
81+
dstDir, err := user.JoinPath(req.DstDir)
82+
if err != nil {
83+
common.ErrorResp(c, err, 403)
84+
return
85+
}
7486
for _, name := range req.Names {
75-
err := fs.Move(c, stdpath.Join(req.SrcDir, name), req.DstDir)
87+
err := fs.Move(c, stdpath.Join(srcDir, name), dstDir)
7688
if err != nil {
7789
common.ErrorResp(c, err, 500)
7890
return
7991
}
8092
}
81-
fs.ClearCache(req.SrcDir)
82-
fs.ClearCache(req.DstDir)
93+
fs.ClearCache(srcDir)
94+
fs.ClearCache(dstDir)
8395
common.SuccessResp(c)
8496
}
8597

@@ -98,11 +110,19 @@ func FsCopy(c *gin.Context) {
98110
common.ErrorResp(c, errs.PermissionDenied, 403)
99111
return
100112
}
101-
req.SrcDir = stdpath.Join(user.BasePath, req.SrcDir)
102-
req.DstDir = stdpath.Join(user.BasePath, req.DstDir)
113+
srcDir, err := user.JoinPath(req.SrcDir)
114+
if err != nil {
115+
common.ErrorResp(c, err, 403)
116+
return
117+
}
118+
dstDir, err := user.JoinPath(req.DstDir)
119+
if err != nil {
120+
common.ErrorResp(c, err, 403)
121+
return
122+
}
103123
var addedTask []string
104124
for _, name := range req.Names {
105-
ok, err := fs.Copy(c, stdpath.Join(req.SrcDir, name), req.DstDir)
125+
ok, err := fs.Copy(c, stdpath.Join(srcDir, name), dstDir)
106126
if ok {
107127
addedTask = append(addedTask, name)
108128
}
@@ -112,7 +132,7 @@ func FsCopy(c *gin.Context) {
112132
}
113133
}
114134
if len(req.Names) != len(addedTask) {
115-
fs.ClearCache(req.DstDir)
135+
fs.ClearCache(dstDir)
116136
}
117137
if len(addedTask) > 0 {
118138
common.SuccessResp(c, fmt.Sprintf("Added %d tasks", len(addedTask)))
@@ -137,12 +157,16 @@ func FsRename(c *gin.Context) {
137157
common.ErrorResp(c, errs.PermissionDenied, 403)
138158
return
139159
}
140-
req.Path = stdpath.Join(user.BasePath, req.Path)
141-
if err := fs.Rename(c, req.Path, req.Name); err != nil {
160+
reqPath, err := user.JoinPath(req.Path)
161+
if err != nil {
162+
common.ErrorResp(c, err, 403)
163+
return
164+
}
165+
if err := fs.Rename(c, reqPath, req.Name); err != nil {
142166
common.ErrorResp(c, err, 500)
143167
return
144168
}
145-
fs.ClearCache(stdpath.Dir(req.Path))
169+
fs.ClearCache(stdpath.Dir(reqPath))
146170
common.SuccessResp(c)
147171
}
148172

@@ -166,9 +190,13 @@ func FsRemove(c *gin.Context) {
166190
common.ErrorResp(c, errs.PermissionDenied, 403)
167191
return
168192
}
169-
req.Dir = stdpath.Join(user.BasePath, req.Dir)
193+
reqDir, err := user.JoinPath(req.Dir)
194+
if err != nil {
195+
common.ErrorResp(c, err, 403)
196+
return
197+
}
170198
for _, name := range req.Names {
171-
err := fs.Remove(c, stdpath.Join(req.Dir, name))
199+
err := fs.Remove(c, stdpath.Join(reqDir, name))
172200
if err != nil {
173201
common.ErrorResp(c, err, 500)
174202
return
@@ -185,8 +213,10 @@ func Link(c *gin.Context) {
185213
common.ErrorResp(c, err, 400)
186214
return
187215
}
188-
user := c.MustGet("user").(*model.User)
189-
rawPath := stdpath.Join(user.BasePath, req.Path)
216+
//user := c.MustGet("user").(*model.User)
217+
//rawPath := stdpath.Join(user.BasePath, req.Path)
218+
// why need not join base_path? because it's always the full path
219+
rawPath := req.Path
190220
storage, err := fs.GetStorage(rawPath)
191221
if err != nil {
192222
common.ErrorResp(c, err, 500)

‎server/handles/fsread.go

+46-27
Original file line numberDiff line numberDiff line change
@@ -56,39 +56,43 @@ func FsList(c *gin.Context) {
5656
}
5757
req.Validate()
5858
user := c.MustGet("user").(*model.User)
59-
req.Path = stdpath.Join(user.BasePath, req.Path)
60-
meta, err := db.GetNearestMeta(req.Path)
59+
reqPath, err := user.JoinPath(req.Path)
60+
if err != nil {
61+
common.ErrorResp(c, err, 403)
62+
return
63+
}
64+
meta, err := db.GetNearestMeta(reqPath)
6165
if err != nil {
6266
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
6367
common.ErrorResp(c, err, 500, true)
6468
return
6569
}
6670
}
6771
c.Set("meta", meta)
68-
if !common.CanAccess(user, meta, req.Path, req.Password) {
72+
if !common.CanAccess(user, meta, reqPath, req.Password) {
6973
common.ErrorStrResp(c, "password is incorrect", 403)
7074
return
7175
}
72-
if !user.CanWrite() && !common.CanWrite(meta, req.Path) && req.Refresh {
76+
if !user.CanWrite() && !common.CanWrite(meta, reqPath) && req.Refresh {
7377
common.ErrorStrResp(c, "Refresh without permission", 403)
7478
return
7579
}
76-
objs, err := fs.List(c, req.Path, req.Refresh)
80+
objs, err := fs.List(c, reqPath, req.Refresh)
7781
if err != nil {
7882
common.ErrorResp(c, err, 500)
7983
return
8084
}
8185
total, objs := pagination(objs, &req.PageReq)
8286
provider := "unknown"
83-
storage, err := fs.GetStorage(req.Path)
87+
storage, err := fs.GetStorage(reqPath)
8488
if err == nil {
8589
provider = storage.GetStorage().Driver
8690
}
8791
common.SuccessResp(c, FsListResp{
88-
Content: toObjsResp(objs, req.Path, isEncrypt(meta, req.Path)),
92+
Content: toObjsResp(objs, reqPath, isEncrypt(meta, reqPath)),
8993
Total: int64(total),
90-
Readme: getReadme(meta, req.Path),
91-
Write: user.CanWrite() || common.CanWrite(meta, req.Path),
94+
Readme: getReadme(meta, reqPath),
95+
Write: user.CanWrite() || common.CanWrite(meta, reqPath),
9296
Provider: provider,
9397
})
9498
}
@@ -100,27 +104,33 @@ func FsDirs(c *gin.Context) {
100104
return
101105
}
102106
user := c.MustGet("user").(*model.User)
107+
var reqPath string
103108
if req.ForceRoot {
104109
if !user.IsAdmin() {
105110
common.ErrorStrResp(c, "Permission denied", 403)
106111
return
107112
}
108113
} else {
109-
req.Path = stdpath.Join(user.BasePath, req.Path)
114+
tmp, err := user.JoinPath(req.Path)
115+
if err != nil {
116+
common.ErrorResp(c, err, 403)
117+
return
118+
}
119+
reqPath = tmp
110120
}
111-
meta, err := db.GetNearestMeta(req.Path)
121+
meta, err := db.GetNearestMeta(reqPath)
112122
if err != nil {
113123
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
114124
common.ErrorResp(c, err, 500, true)
115125
return
116126
}
117127
}
118128
c.Set("meta", meta)
119-
if !common.CanAccess(user, meta, req.Path, req.Password) {
129+
if !common.CanAccess(user, meta, reqPath, req.Password) {
120130
common.ErrorStrResp(c, "password is incorrect", 403)
121131
return
122132
}
123-
objs, err := fs.List(c, req.Path)
133+
objs, err := fs.List(c, reqPath)
124134
if err != nil {
125135
common.ErrorResp(c, err, 500)
126136
return
@@ -218,27 +228,31 @@ func FsGet(c *gin.Context) {
218228
return
219229
}
220230
user := c.MustGet("user").(*model.User)
221-
req.Path = stdpath.Join(user.BasePath, req.Path)
222-
meta, err := db.GetNearestMeta(req.Path)
231+
reqPath, err := user.JoinPath(req.Path)
232+
if err != nil {
233+
common.ErrorResp(c, err, 403)
234+
return
235+
}
236+
meta, err := db.GetNearestMeta(reqPath)
223237
if err != nil {
224238
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
225239
common.ErrorResp(c, err, 500)
226240
return
227241
}
228242
}
229243
c.Set("meta", meta)
230-
if !common.CanAccess(user, meta, req.Path, req.Password) {
244+
if !common.CanAccess(user, meta, reqPath, req.Password) {
231245
common.ErrorStrResp(c, "password is incorrect", 403)
232246
return
233247
}
234-
obj, err := fs.Get(c, req.Path)
248+
obj, err := fs.Get(c, reqPath)
235249
if err != nil {
236250
common.ErrorResp(c, err, 500)
237251
return
238252
}
239253
var rawURL string
240254

241-
storage, err := fs.GetStorage(req.Path)
255+
storage, err := fs.GetStorage(reqPath)
242256
provider := "unknown"
243257
if err == nil {
244258
provider = storage.Config().Name
@@ -252,21 +266,21 @@ func FsGet(c *gin.Context) {
252266
if storage.GetStorage().DownProxyUrl != "" {
253267
rawURL = fmt.Sprintf("%s%s?sign=%s",
254268
strings.Split(storage.GetStorage().DownProxyUrl, "\n")[0],
255-
utils.EncodePath(req.Path, true),
256-
sign.Sign(req.Path))
269+
utils.EncodePath(reqPath, true),
270+
sign.Sign(reqPath))
257271
} else {
258272
rawURL = fmt.Sprintf("%s/p%s?sign=%s",
259273
common.GetApiUrl(c.Request),
260-
utils.EncodePath(req.Path, true),
261-
sign.Sign(req.Path))
274+
utils.EncodePath(reqPath, true),
275+
sign.Sign(reqPath))
262276
}
263277
} else {
264278
// file have raw url
265279
if u, ok := obj.(model.URL); ok {
266280
rawURL = u.URL()
267281
} else {
268282
// if storage is not proxy, use raw url by fs.Link
269-
link, _, err := fs.Link(c, req.Path, model.LinkArgs{IP: c.ClientIP(), Header: c.Request.Header})
283+
link, _, err := fs.Link(c, reqPath, model.LinkArgs{IP: c.ClientIP(), Header: c.Request.Header})
270284
if err != nil {
271285
common.ErrorResp(c, err, 500)
272286
return
@@ -276,7 +290,7 @@ func FsGet(c *gin.Context) {
276290
}
277291
}
278292
var related []model.Obj
279-
parentPath := stdpath.Dir(req.Path)
293+
parentPath := stdpath.Dir(reqPath)
280294
sameLevelFiles, err := fs.List(c, parentPath)
281295
if err == nil {
282296
related = filterRelated(sameLevelFiles, obj)
@@ -288,11 +302,11 @@ func FsGet(c *gin.Context) {
288302
Size: obj.GetSize(),
289303
IsDir: obj.IsDir(),
290304
Modified: obj.ModTime(),
291-
Sign: common.Sign(obj, parentPath, isEncrypt(meta, req.Path)),
305+
Sign: common.Sign(obj, parentPath, isEncrypt(meta, reqPath)),
292306
Type: utils.GetFileType(obj.GetName()),
293307
},
294308
RawURL: rawURL,
295-
Readme: getReadme(meta, req.Path),
309+
Readme: getReadme(meta, reqPath),
296310
Provider: provider,
297311
Related: toObjsResp(related, parentPath, isEncrypt(parentMeta, parentPath)),
298312
})
@@ -324,7 +338,12 @@ func FsOther(c *gin.Context) {
324338
return
325339
}
326340
user := c.MustGet("user").(*model.User)
327-
req.Path = stdpath.Join(user.BasePath, req.Path)
341+
var err error
342+
req.Path, err = user.JoinPath(req.Path)
343+
if err != nil {
344+
common.ErrorResp(c, err, 403)
345+
return
346+
}
328347
meta, err := db.GetNearestMeta(req.Path)
329348
if err != nil {
330349
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {

0 commit comments

Comments
 (0)