Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: implement Phase 1 and 2 security remediations
Some checks failed
Automated Container Build / build-and-push (push) Has been cancelled
Details

Browse source
This commit is contained in:
Elijah 2026-05-26 13:32:09 -07:00
parent 82731e93b1
commit 701766b611
14 changed files with 213 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

22
backend/handlers/onlyoffice.go
View file

@ -40,7 +40,7 @@ func (h *OnlyOfficeHandler) Callback(c *fiber.Ctx) error {
}
// Validate the token to ensure the callback is authorized
if err := middleware.ValidateDownloadToken(token, h.Config.JWTSecret, ""); err != nil {
if err := middleware.ValidateDownloadToken(token, h.Config.JWTSecret, "", path); err != nil {
return c.Status(401).SendString("unauthorized")
}
@ -60,14 +60,22 @@ func (h *OnlyOfficeHandler) Callback(c *fiber.Ctx) error {
// we can rewrite it to use the internal Docker IP
downloadUrl := req.Url
trustedHosts := []string{h.Config.OnlyOfficeHost}
if err := validateCallbackURL(downloadUrl, trustedHosts); err != nil {
return c.Status(403).JSON(fiber.Map{"error": "blocked URL: " + err.Error()})
}
// Download modified file from Document Server
resp, err := http.Get(downloadUrl)
resp, err := SafeHTTPClient.Get(downloadUrl)
if err != nil {
return c.Status(500).JSON(fiber.Map{"error": "failed to download file"})
}
defer resp.Body.Close()
targetPath := filepath.Join(h.Config.StorageDir, path)
targetPath, err := resolveSafe(h.Config.StorageDir, path)
if err != nil {
return c.Status(403).JSON(fiber.Map{"error": "invalid path"})
}
// Save file
out, err := os.Create(targetPath)
@ -145,18 +153,16 @@ func (h *OnlyOfficeHandler) DownloadForEditor(c *fiber.Ctx) error {
}
// Validate the download token
if err := middleware.ValidateDownloadToken(token, h.Config.JWTSecret, ""); err != nil {
if err := middleware.ValidateDownloadToken(token, h.Config.JWTSecret, "", path); err != nil {
return c.Status(401).JSON(fiber.Map{"error": "unauthorized"})
}
// Jail the path to the storage directory
cleaned := filepath.Clean(path)
if filepath.IsAbs(cleaned) || cleaned == ".." || len(cleaned) > 2 && cleaned[:3] == ".." + string(filepath.Separator) {
fullPath, err := resolveSafe(h.Config.StorageDir, path)
if err != nil {
return c.Status(403).JSON(fiber.Map{"error": "invalid path"})
}
fullPath := filepath.Join(h.Config.StorageDir, cleaned)
info, err := os.Stat(fullPath)
if err != nil || info.IsDir() {
return c.Status(404).JSON(fiber.Map{"error": "file not found"})