Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: implement Phase 1 and 2 security remediations
Some checks failed
Automated Container Build / build-and-push (push) Has been cancelled
Details

Browse source
This commit is contained in:
Elijah 2026-05-26 13:32:09 -07:00
parent 82731e93b1
commit 701766b611
14 changed files with 213 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

10
backend/workers/tasks.go
View file

@ -208,9 +208,13 @@ func UnzipAsync(taskID string, sourceFull, destFolder string) {
for i, f := range r.File {
// Prevent Zip Slip vulnerability
fpath := filepath.Join(destFolder, f.Name)
if !strings.HasPrefix(fpath, filepath.Clean(destFolder)+string(os.PathSeparator)) {
continue // Skip malicious paths
fpath := filepath.Join(destFolder, filepath.FromSlash(f.Name))
absDestFolder, _ := filepath.Abs(destFolder)
absFpath, _ := filepath.Abs(fpath)
if !strings.HasPrefix(absFpath, absDestFolder+string(os.PathSeparator)) {
Tasks.FailTask(taskID, fmt.Errorf("zip slip detected: %s attempts to escape to %s", f.Name, absFpath))
return
}
if f.FileInfo().IsDir() {