Merge pull request #4386 from nextcloud/backport/4368/stable31

[stable31] fix(FolderController): Sanitize mountpoints correctly

Author: provokateurin

lib/Command/Create.php

@@ -30,7 +30,7 @@ protected function configure(): void {
 	}
 
 	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$id = $this->folderManager->createFolder($input->getArgument('name'));
+		$id = $this->folderManager->createFolder($this->folderManager->trimMountpoint((string)$input->getArgument('name')));
 		$output->writeln((string)$id);
 
 		return 0;

lib/Command/Rename.php

@@ -28,7 +28,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 			return -1;
 		}
 
-		$this->folderManager->renameFolder($folder['id'], $input->getArgument('name'));
+		$this->folderManager->renameFolder($folder['id'], $this->folderManager->trimMountpoint((string)$input->getArgument('name')));
 
 		return 0;
 	}

lib/Controller/FolderController.php

@@ -220,13 +220,14 @@ private function getRootFolderStorageId(): ?int {
 	#[NoAdminRequired]
 	#[FrontpageRoute(verb: 'POST', url: '/folders')]
 	public function addFolder(string $mountpoint): DataResponse {
+		$mountpoint = $this->manager->trimMountpoint($mountpoint);
 
 		$storageId = $this->rootFolder->getMountPoint()->getNumericStorageId();
 		if ($storageId === null) {
 			throw new OCSNotFoundException();
 		}
 
-		$id = $this->manager->createFolder(trim($mountpoint));
+		$id = $this->manager->createFolder($mountpoint);
 		$folder = $this->manager->getFolder($id, $storageId);
 		if ($folder === null) {
 			throw new OCSNotFoundException();
@@ -280,7 +281,8 @@ public function removeFolder(int $id): DataResponse {
 	#[NoAdminRequired]
 	#[FrontpageRoute(verb: 'PUT', url: '/folders/{id}')]
 	public function setMountPoint(int $id, string $mountPoint): DataResponse {
-		$this->manager->renameFolder($id, trim($mountPoint));
+		$mountPoint = $this->manager->trimMountpoint($mountPoint);
+		$this->manager->renameFolder($id, $mountPoint);
 		return new DataResponse(['success' => true]);
 	}
 
@@ -457,7 +459,8 @@ public function renameFolder(int $id, string $mountpoint): DataResponse {
 			return $response;
 		}
 
-		$this->manager->renameFolder($id, trim($mountpoint));
+		$mountpoint = $this->manager->trimMountpoint($mountpoint);
+		$this->manager->renameFolder($id, $mountpoint);
 
 		return new DataResponse(['success' => true]);
 	}

lib/Folder/FolderManager.php

@@ -8,6 +8,7 @@
 
 use OC\Files\Cache\Cache;
 use OC\Files\Cache\CacheEntry;
+use OC\Files\Filesystem;
 use OC\Files\Node\Node;
 use OCA\Circles\CirclesManager;
 use OCA\Circles\Exceptions\CircleNotFoundException;
@@ -20,6 +21,7 @@
 use OCA\GroupFolders\Mount\FolderStorageManager;
 use OCA\GroupFolders\Mount\GroupMountPoint;
 use OCA\GroupFolders\ResponseDefinitions;
+use OCP\AppFramework\OCS\OCSBadRequestException;
 use OCP\AutoloadNotAllowedException;
 use OCP\Constants;
 use OCP\DB\Exception;
@@ -767,6 +769,31 @@ public function getFoldersFromCircleMemberships(IUser $user, int $rootStorageId
 		], array_values($query->executeQuery()->fetchAll()));
 	}
 
+	public function trimMountpoint(string $mountpoint): string {
+		// Remove whitespace
+		$mountpoint = trim($mountpoint);
+
+		$mountpoint = FileSystem::normalizePath($mountpoint);
+
+		// Used to mount a Team folder at the user's home.
+		if ($mountpoint === '/') {
+			return $mountpoint;
+		}
+
+		// Remove leading slash
+		$mountpoint = substr($mountpoint, 1);
+
+		if (str_contains($mountpoint, '..')) {
+			throw new OCSBadRequestException('Mount point cannot contain ".."');
+		}
+
+		// Check if the new mountpoint is valid
+		if ($mountpoint === '') {
+			throw new OCSBadRequestException('Mount point cannot be empty');
+		}
+
+		return $mountpoint;
+	}
 
 	/**
 	 * @throws Exception

src/settings/App.tsx

@@ -18,6 +18,13 @@ import AdminGroupSelect from './AdminGroupSelect'
 import SubAdminGroupSelect from './SubAdminGroupSelect'
 import { loadState } from '@nextcloud/initial-state'
 import { t } from '@nextcloud/l10n'
+import { isAxiosError } from '@nextcloud/axios'
+import { getLoggerBuilder } from '@nextcloud/logger'
+
+const logger = getLoggerBuilder()
+	.setApp('groupfolders')
+	.detectUser()
+	.build()
 
 const bytesInOneGibibyte = Math.pow(1024, 3)
 const defaultQuotaOptions = {
@@ -96,10 +103,22 @@ export class App extends Component<unknown, AppState> implements OC.Plugin<OC.Se
 		if (!mountPoint) {
 			return
 		}
-		const folder = await this.api.createFolder(mountPoint)
-		const folders = this.state.folders
-		folders.push(folder)
-		this.setState({ folders, newMountPoint: '' })
+		try {
+			const folder = await this.api.createFolder(mountPoint)
+			const folders = this.state.folders
+			folders.push(folder)
+			this.setState({ folders, newMountPoint: '' })
+		} catch (error) {
+			logger.error('Error while creating new folder', { error })
+
+			if (isAxiosError(error) && error.response?.data.message) {
+				// @ts-expect-error TS2339
+				window.OCP.Toast.error(error.response.data.message)
+			} else {
+				// @ts-expect-error TS2339
+				window.OCP.Toast.error(t('groupfolders', 'Folder could not be created'))
+			}
+		}
 	}
 
 	attach = (search: OC.Search.Core) => {
@@ -159,10 +178,22 @@ export class App extends Component<unknown, AppState> implements OC.Plugin<OC.Se
 	}
 
 	async renameFolder(folder: Folder, newName: string) {
-		await this.api.renameFolder(folder.id, newName)
-		const folders = this.state.folders
-		folder.mount_point = newName
-		this.setState({ folders, editingMountPoint: 0 })
+		try {
+			await this.api.renameFolder(folder.id, newName)
+			const folders = this.state.folders
+			folder.mount_point = newName
+			this.setState({ folders, editingMountPoint: 0 })
+		} catch (error) {
+			logger.error('Error while renaming folder', { error })
+
+			if (isAxiosError(error) && error.response?.data.message) {
+				// @ts-expect-error TS2339
+				window.OCP.Toast.error(error.response.data.message)
+			} else {
+				// @ts-expect-error TS2339
+				window.OCP.Toast.error(t('groupfolders', 'Folder could not be renamed'))
+			}
+		}
 	}
 
 	async setAcl(folder: Folder, acl: boolean) {