Skip to content

Commit 72c1647

Browse files
author
midu
committed
Revert "Sanitize the filename to prevent path traversal attacks"
This reverts commit 43d7e5e.
1 parent 9215963 commit 72c1647

File tree

1 file changed

+5
-20
lines changed

1 file changed

+5
-20
lines changed

pkg/cli/rsync/copy_tar.go

Lines changed: 5 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -64,30 +64,15 @@ func deleteContents(dir string) error {
6464
return err
6565
}
6666
for _, f := range files {
67-
// Sanitize the filename to prevent path traversal attacks
68-
fileName := f.Name()
69-
if strings.Contains(fileName, "..") || strings.Contains(fileName, "/") || strings.Contains(fileName, "\\") {
70-
klog.V(4).Infof("Skipping potentially malicious filename: %s", fileName)
71-
continue
72-
}
73-
74-
// Ensure the resolved path is still within the target directory
75-
targetPath := filepath.Join(dir, fileName)
76-
cleanPath := filepath.Clean(targetPath)
77-
if !strings.HasPrefix(cleanPath, filepath.Clean(dir)+string(filepath.Separator)) && cleanPath != filepath.Clean(dir) {
78-
klog.V(4).Infof("Skipping path traversal attempt: %s", fileName)
79-
continue
80-
}
81-
8267
if f.IsDir() {
83-
klog.V(5).Infof("Deleting directory: %s", fileName)
84-
err = os.RemoveAll(cleanPath)
68+
klog.V(5).Infof("Deleting directory: %s", f.Name())
69+
err = os.RemoveAll(filepath.Clean(filepath.Join(dir, f.Name())))
8570
} else {
86-
klog.V(5).Infof("Deleting file: %s", fileName)
87-
err = os.Remove(cleanPath)
71+
klog.V(5).Infof("Deleting file: %s", f.Name())
72+
err = os.Remove(filepath.Clean(filepath.Join(dir, f.Name())))
8873
}
8974
if err != nil {
90-
klog.V(4).Infof("Error deleting file or directory: %s: %v", fileName, err)
75+
klog.V(4).Infof("Error deleting file or directory: %s: %v", f.Name(), err)
9176
return err
9277
}
9378
}

0 commit comments

Comments
 (0)