raphael/whiteboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security improvements: protect from directory traversal and iFrame content injection

Browse Source
This commit is contained in:
Daniel 2021-07-12 17:14:43 +00:00
parent 7b3665da6e
commit c223589add
No known key found for this signature in database
GPG Key ID: 4940B41048AF73EA
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
scripts/s_whiteboard.js
View File

@ -1,6 +1,8 @@
//This file is only for saving the whiteboard.
const fs = require("fs");
const path = require("path");
const config = require("./config/config");
const FILE_DATABASE_FOLDER = "savedBoards";
var savedBoards = {};
var savedUndos = {};
@ -144,7 +146,13 @@ module.exports = {
// try to load from DB
if (config.backend.enableFileDatabase) {
//read saved board from file
var filePath = "savedBoards/" + wid + ".json";
var fileName = wid + ".json";
var filePath = FILE_DATABASE_FOLDER + "/" + fileName;
if(path.dirname(filePath) !== FILE_DATABASE_FOLDER || path.basename(fileName) !== fileName) {
var errorMessage = "Attempted path traversal attack: ";
console.log(errorMessage, filePath);
throw new Error(errorMessage + filePath);
}
if (fs.existsSync(filePath)) {
var data = fs.readFileSync(filePath);
if (data) {

2
src/js/main.js
View File

@ -907,7 +907,7 @@ function initWhiteboard() {
// handle pasting from clipboard
window.addEventListener("paste", function (e) {
if ($(".basicalert").length > 0) {
if ($(".basicalert").length > 0 || !!e.origin) {
return;
}
if (e.clipboardData) {