Merge pull request #8 from chhtw/security-fixes

chhtw · web-flow · commit 92121609e644 · 2024-08-29T13:07:49.000+08:00
fix securiyt issue
diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,3 @@
 
 .DS_Store
+ src/Application/src/RazorPagesTestSample/config.json
diff --git a/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs b/src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs
@@ -94,7 +94,11 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()
 
         public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
         {
-            string destFileName = Path.Combine(destDirectory, entry.FullName);
+            string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
+            string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);
+            if (!destFileName.StartsWith(fullDestDirPath)) {
+                throw new System.InvalidOperationException("Entry is outside the target dir: " + destFileName);
+            }
             entry.ExtractToFile(destFileName);
         }
     }
diff --git a/src/Application/src/RazorPagesTestSample/config.json b/src/Application/src/RazorPagesTestSample/config.json
diff --git a/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj b/src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj
@@ -13,7 +13,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="8.0.3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
     <PackageReference Include="Moq" Version="4.20.70" />
-    <PackageReference Include="Newtonsoft.Json" Version="11.0.2" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="System.Diagnostics.TraceSource" Version="4.3.0" />
     <PackageReference Include="System.Net.Http" Version="4.3.4" />
     <PackageReference Include="xunit" Version="2.7.0" />

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`
`2`	`2`	`.DS_Store`
	`3`	`+ src/Application/src/RazorPagesTestSample/config.json`
Original file line number	Diff line number	Diff line change
`@@ -94,7 +94,11 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()`
`94`	`94`
`95`	`95`	`public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)`
`96`	`96`	`{`
`97`		`- string destFileName = Path.Combine(destDirectory, entry.FullName);`
	`97`	`+ string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));`
	`98`	`+ string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);`
	`99`	`+ if (!destFileName.StartsWith(fullDestDirPath)) {`
	`100`	`+ throw new System.InvalidOperationException("Entry is outside the target dir: " + destFileName);`
	`101`	`+ }`
`98`	`102`	`entry.ExtractToFile(destFileName);`
`99`	`103`	`}`
`100`	`104`	`}`