Elijah/convertor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: fix path traversal vulnerability in conversion API

Browse source
This commit is contained in:
Your Name 2026-02-08 12:50:48 +01:00
parent debbe5d1d4
commit edea7a55dc
2 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/converters/main.ts
View file

@ -164,13 +164,15 @@ export async function handleConvert(
const toProcess: Promise<string>[] = []; const toProcess: Promise<string>[] = [];
for (const fileName of chunk) { for (const fileName of chunk) {
const filePath = `${userUploadsDir}${fileName}`; const filePath = `${userUploadsDir}${fileName}`;
const fileTypeOrig = fileName.split(".").pop() ?? ""; const fileTypeOrig = fileName.includes(".") ? (fileName.split(".").pop() ?? "") : "";
const fileType = normalizeFiletype(fileTypeOrig); const fileType = normalizeFiletype(fileTypeOrig);
const newFileExt = normalizeOutputFiletype(convertTo); const newFileExt = normalizeOutputFiletype(convertTo);
const newFileName = fileName.replace( let newFileName: string;
new RegExp(`${fileTypeOrig}(?!.*${fileTypeOrig})`), if (fileTypeOrig === "") {
newFileExt, newFileName = `${fileName}.${newFileExt}`;
); } else {
newFileName = fileName.replace(new RegExp(`${fileTypeOrig}(?!.*${fileTypeOrig})`), newFileExt);
}
const targetPath = `${userOutputDir}${newFileName}`; const targetPath = `${userOutputDir}${newFileName}`;
toProcess.push( toProcess.push(
new Promise((resolve, reject) => { new Promise((resolve, reject) => {

2
src/pages/convert.tsx
View file

@ -47,7 +47,7 @@ export const convert = new Elysia().use(userService).post(
const convertTo = normalizeFiletype(body.convert_to.split(",")[0] ?? ""); const convertTo = normalizeFiletype(body.convert_to.split(",")[0] ?? "");
const converterName = body.convert_to.split(",")[1]; const converterName = body.convert_to.split(",")[1];
if (!converterName) { if (!converterName || convertTo.includes("/") || convertTo.includes("\\") || convertTo.includes("..")) {
return redirect(`${WEBROOT}/`, 302); return redirect(`${WEBROOT}/`, 302);
} }