diff --git a/.gitignore b/.gitignore index 9bea4330..62a88f7b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ .DS_Store +src/Application/src/RazorPagesTestSample/config.json diff --git a/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs b/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs index 2e6d94bb..c399880a 100644 --- a/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs +++ b/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs @@ -95,6 +95,13 @@ public async Task OnPostAnalyzeMessagesAsync() public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory) { string destFileName = Path.Combine(destDirectory, entry.FullName); + + // Ensure the destination file is within the destination directory + if (!Path.GetFullPath(destFileName).StartsWith(Path.GetFullPath(destDirectory), StringComparison.Ordinal)) + { + throw new InvalidOperationException("Entry is trying to write outside of the destination directory."); + } + entry.ExtractToFile(destFileName); } } diff --git a/src/Application/src/RazorPagesTestSample/config.json b/src/Application/src/RazorPagesTestSample/config.json deleted file mode 100644 index 1a3874d4..00000000 --- a/src/Application/src/RazorPagesTestSample/config.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "registry_key": "8yYKDsFTjatiQI9nVcsoQ1P3rdnh+P5Mlz9gVBgVgx+ACRArmBQ3", - "registry_type": "AzureContainerRegistry" -} \ No newline at end of file diff --git a/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj b/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj index a66e0a92..079d0c9f 100644 --- a/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj +++ b/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj @@ -13,7 +13,7 @@ - +