Merge pull request #12 from marcelloraffaele/security-fixes

marcelloraffaele · web-flow · commit d2769b083c81 · 2024-10-30T13:31:07.000+01:00
security update resolve #11
diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,3 @@
 
 .DS_Store
+src/Application/src/RazorPagesTestSample/config.json
diff --git a/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs b/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs
@@ -95,6 +95,13 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()
         public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
         {
             string destFileName = Path.Combine(destDirectory, entry.FullName);
+
+            // Ensure the destination file is within the destination directory
+            if (!Path.GetFullPath(destFileName).StartsWith(Path.GetFullPath(destDirectory), StringComparison.Ordinal))
+            {
+            throw new InvalidOperationException("Entry is trying to write outside of the destination directory.");
+            }
+
             entry.ExtractToFile(destFileName);
         }
     }
diff --git a/src/Application/src/RazorPagesTestSample/config.json b/src/Application/src/RazorPagesTestSample/config.json
diff --git a/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj b/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj
@@ -13,7 +13,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="8.0.3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
     <PackageReference Include="Moq" Version="4.20.70" />
-    <PackageReference Include="Newtonsoft.Json" Version="11.0.2" />
+    <PackageReference Include="Newtonsoft.Json" Version="11.0.3" />
     <PackageReference Include="System.Diagnostics.TraceSource" Version="4.3.0" />
     <PackageReference Include="System.Net.Http" Version="4.3.4" />
     <PackageReference Include="xunit" Version="2.7.0" />

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`
`2`	`2`	`.DS_Store`
	`3`	`+src/Application/src/RazorPagesTestSample/config.json`
Original file line number	Diff line number	Diff line change
`@@ -95,6 +95,13 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()`
`95`	`95`	`public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)`
`96`	`96`	`{`
`97`	`97`	`string destFileName = Path.Combine(destDirectory, entry.FullName);`
	`98`	`+`
	`99`	`+ // Ensure the destination file is within the destination directory`
	`100`	`+ if (!Path.GetFullPath(destFileName).StartsWith(Path.GetFullPath(destDirectory), StringComparison.Ordinal))`
	`101`	`+ {`
	`102`	`+ throw new InvalidOperationException("Entry is trying to write outside of the destination directory.");`
	`103`	`+ }`
	`104`	`+`
`98`	`105`	`entry.ExtractToFile(destFileName);`
`99`	`106`	`}`
`100`	`107`	`}`