sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17879 from owncloud/scan-check-path 

check if the user is trying to scan a valid path
remotes/origin/handlebars-approach
Thomas Müller 2015-07-27 13:39:53 +07:00
parent e68741c1b0 c20d4d1a0b
commit c030ae9dec
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/private/files/utils/scanner.php
Unescape Escape View File

@ -131,6 +131,9 @@ class Scanner extends PublicEmitter {
* @throws \OC\ForbiddenException * @throws \OC\ForbiddenException
*/ */
public function scan($dir = '') { public function scan($dir = '') {
if (!Filesystem::isValidPath($dir)) {
throw new \InvalidArgumentException('Invalid path to scan');
}
$mounts = $this->getMounts($dir); $mounts = $this->getMounts($dir);
foreach ($mounts as $mount) { foreach ($mounts as $mount) {
if (is_null($mount->getStorage())) { if (is_null($mount->getStorage())) {

28
tests/lib/files/utils/scanner.php
Unescape Escape View File

@ -189,4 +189,32 @@ class Scanner extends \Test\TestCase {
$newInfo = $cache->get(''); $newInfo = $cache->get('');
$this->assertNotEquals($oldInfo['etag'], $newInfo['etag']); $this->assertNotEquals($oldInfo['etag'], $newInfo['etag']);
} }
/**
* @return array
*/
public function invalidPathProvider() {
return [
[
'../',
],
[
'..\\',
],
[
'../..\\../',
],
];
}
/**
* @dataProvider invalidPathProvider
* @expectedException \InvalidArgumentException
* @expectedExceptionMessage Invalid path to scan
* @param string $invalidPath
*/
public function testInvalidPathScanning($invalidPath) {
$scanner = new TestScanner('', \OC::$server->getDatabaseConnection());
$scanner->scan($invalidPath);
}
} }