Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use file name whitelist to prevent RCE #4866

Merged
merged 4 commits into from Aug 22, 2018
Merged

Use file name whitelist to prevent RCE #4866

merged 4 commits into from Aug 22, 2018

Commits on Aug 8, 2018

  1. Use file name whitelist to prevent RCE 

    Use a whitelist to validate user-provided file names. This doesn't cover
the entire range of valid filenames but should cover almost all of them
in practice. Allows letters, numbers, periods, dashes, and underscores.
Opting to use a whitelist instead of a blacklist because getting this
wrong leaves us vulnerable to a RCE attack.
    @acdlite
    acdlite committed Aug 8, 2018
    Copy the full SHA
    4165185 View commit details
    Browse the repository at this point in the history

  2. Allow alphabet characters from all languages 

    Updated the whitelist to /^[\p{L}0-9/.\-_]+$/u, which matches
alphanumeric characters, periods, dashes, and underscores. Unicode
property support is stage 4 so I've inlined the transpiled version.
    @acdlite
    acdlite committed Aug 8, 2018
    Copy the full SHA
    a5f27ce View commit details
    Browse the repository at this point in the history

  3. Only use file name whitelist on Windows

    @acdlite
    acdlite committed Aug 8, 2018
    Copy the full SHA
    7814826 View commit details
    Browse the repository at this point in the history

  4. Log error message if file name does not pass whitelist

    @acdlite
    acdlite committed Aug 8, 2018
    Copy the full SHA
    c1ef946 View commit details
    Browse the repository at this point in the history