Update .gitignore, enhance file extraction safety, and upgrade Newtonsoft.Json package

Frederic Wickert · Frederic Wickert · commit 68f137ebb01d · 2024-10-30T11:05:48.000+01:00
diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,6 @@
 
 .DS_Store
+
+ # Local configuration file for developers
+ src/Application/src/RazorPagesTestSample/config.json
+
diff --git a/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs b/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs
@@ -94,7 +94,13 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()
 
         public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
         {
-            string destFileName = Path.Combine(destDirectory, entry.FullName);
+            string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
+
+            if (!destFileName.StartsWith(destDirectory, StringComparison.OrdinalIgnoreCase))
+            {
+                throw new InvalidOperationException("Entry is outside of the target directory.");
+            }
+
             entry.ExtractToFile(destFileName);
         }
     }
diff --git a/src/Application/src/RazorPagesTestSample/config.json b/src/Application/src/RazorPagesTestSample/config.json
diff --git a/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj b/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj
@@ -13,7 +13,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="8.0.3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
     <PackageReference Include="Moq" Version="4.20.70" />
-    <PackageReference Include="Newtonsoft.Json" Version="11.0.2" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="System.Diagnostics.TraceSource" Version="4.3.0" />
     <PackageReference Include="System.Net.Http" Version="4.3.4" />
     <PackageReference Include="xunit" Version="2.7.0" />

Original file line number	Diff line number	Diff line change
`@@ -94,7 +94,13 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()`
`94`	`94`
`95`	`95`	`public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)`
`96`	`96`	`{`
`97`		`- string destFileName = Path.Combine(destDirectory, entry.FullName);`
	`97`	`+ string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));`
	`98`	`+`
	`99`	`+ if (!destFileName.StartsWith(destDirectory, StringComparison.OrdinalIgnoreCase))`
	`100`	`+ {`
	`101`	`+ throw new InvalidOperationException("Entry is outside of the target directory.");`
	`102`	`+ }`
	`103`	`+`
`98`	`104`	`entry.ExtractToFile(destFileName);`
`99`	`105`	`}`
`100`	`106`	`}`