rejecting allowed relative paths

projectdiscovery · Jul 23, 2023 · a910ab7 · a910ab7
1 parent 99bb3bb
commit a910ab7
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/file/file.go b/file/file.go
@@ -49,6 +49,11 @@ func FileExistsIn(file string, allowedPaths ...string) (string, error) {
 		if err != nil {
 			return "", err
 		}
+		// reject any path that for some reason was cleaned up and starts with .
+		if stringsutil.HasPrefixAny(allowedAbsPath, ".") {
+			return "", errors.New("invalid path")
+		}
+
 		allowedDirPath := allowedAbsPath
 		if filepath.Ext(allowedAbsPath) != "" {
 			allowedDirPath = filepath.Dir(allowedAbsPath)

diff --git a/file/file_test.go b/file/file_test.go
@@ -590,6 +590,7 @@ func TestFileExistsIn(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to write to temporary file: %v", err)
 	}
+	defer os.RemoveAll(tempFile)
 
 	tests := []struct {
 		name         string
@@ -612,6 +613,13 @@ func TestFileExistsIn(t *testing.T) {
 			expectedPath: "",
 			expectedErr:  true,
 		},
+		{
+			name:         "path starting with .",
+			file:         tempFile,
+			allowedFiles: []string{"."},
+			expectedPath: "",
+			expectedErr:  true,
+		},
 	}
 
 	for _, tc := range tests {