Merge pull request #9 from Puneet-Minhas/security-fixes

Security fixes

Author: Puneet-Minhas

.github/workflows/reusable-cd.yml

@@ -18,7 +18,7 @@ jobs:
         id-token: write
       environment:
         name: ${{ inputs.environment }}
-        url: "https://techexcel-${{ inputs.environment }}.azurewebsites.net/"
+        url: "https://ghwxvgb4jngfa-${{ inputs.environment }}.azurewebsites.net/"
       steps:
         - uses: azure/[email protected]
           with:

.gitignore

@@ -1,2 +1,4 @@
 
 .DS_Store
+ # Local configuration file for developers
+ src/Application/src/RazorPagesTestSample/config.json

src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs

@@ -92,10 +92,16 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()
             return RedirectToPage();
         }
 
-        public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
-        {
-            string destFileName = Path.Combine(destDirectory, entry.FullName);
-            entry.ExtractToFile(destFileName);
-        }
+     
+        
+ public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
+ {
+     string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
+     string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);
+     if (!destFileName.StartsWith(fullDestDirPath)) {
+         throw new System.InvalidOperationException("Entry is outside the target dir: " + destFileName);
+     }
+     entry.ExtractToFile(destFileName);
+ }
     }
 }

src/Application/src/RazorPagesTestSample/config.json

@@ -13,7 +13,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="8.0.3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
     <PackageReference Include="Moq" Version="4.20.70" />
-    <PackageReference Include="Newtonsoft.Json" Version="11.0.2" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="System.Diagnostics.TraceSource" Version="4.3.0" />
     <PackageReference Include="System.Net.Http" Version="4.3.4" />
     <PackageReference Include="xunit" Version="2.7.0" />