oscar-surf/misskey
oscar-surf/misskey
0
0
Fork 0
Code Issues Activity

fix(server): validate filename and emoji name to improve security

Browse source
This commit is contained in:
syuilo 2023-02-05 14:25:37 +09:00
parent f599337320
commit 0d7256678e
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
packages/backend/src/queue/processors/ImportCustomEmojisProcessorService.ts
View file

@ -81,6 +81,10 @@ export class ImportCustomEmojisProcessorService {
for (const record of meta.emojis) {
if (!record.downloaded) continue;
if (!/^[a-zA-Z0-9_]+?([a-zA-Z0-9\.]+)?$/.test(record.fileName)) {
this.logger.error(`invalid filename: ${record.fileName}`);
continue;
}
const emojiInfo = record.emoji;
const emojiPath = outputPath + '/' + record.fileName;
await this.emojisRepository.delete({