Elijah/convertor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: fix path traversal vulnerability in conversion API (#532)

Browse source
This commit is contained in:
Fluxmux 2026-04-27 21:43:47 +02:00 • committed by GitHub
parent 1ba82cf1b2
commit 0965928949
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 16 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/pages/convert.tsx
View file

@ -47,7 +47,12 @@ export const convert = new Elysia().use(userService).post(
const convertTo = normalizeFiletype(body.convert_to.split(",")[0] ?? "");
const converterName = body.convert_to.split(",")[1];
if (!converterName) {
if (
!converterName ||
convertTo.includes("/") ||
convertTo.includes("\\") ||
convertTo.includes("..")
) {
return redirect(`${WEBROOT}/`, 302);
}