Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: remediate vulnerabilities and issues from codebase audit
All checks were successful
Automated Container Build / build-and-push (push) Successful in 1m15s
Details

Browse source
This commit is contained in:
Elijah 2026-05-23 10:04:08 -07:00
parent b60a09196a
commit fb3f3a3393
15 changed files with 465 additions and 208 deletions
Download patch file Download diff file Expand all files Collapse all files

6
backend/workers/tasks.go
View file

@ -208,13 +208,11 @@ func UnzipAsync(taskID string, sourceFull, destFolder string) {
for i, f := range r.File {
// Prevent Zip Slip vulnerability
cleanPath := filepath.Clean(f.Name)
if strings.HasPrefix(cleanPath, "..") {
fpath := filepath.Join(destFolder, f.Name)
if !strings.HasPrefix(fpath, filepath.Clean(destFolder)+string(os.PathSeparator)) {
continue // Skip malicious paths
}
fpath := filepath.Join(destFolder, cleanPath)
if f.FileInfo().IsDir() {
os.MkdirAll(fpath, os.ModePerm)
continue