From: Claudio Cambra <claudio.cambra@nextcloud.com>
Date: Wed, 26 Oct 2022 14:07:59 +0000 (+0200)
Subject: Make sure to check relPath and compare to canonical cleaned path
X-Git-Tag: archive/raspbian/3.16.7-1_deb13u1+rpi1~1^2~12^2~11^2~179^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=0b33ce2b40285d87150abd745a1ad90661be6c81;p=nextcloud-desktop.git

Make sure to check relPath and compare to canonical cleaned path

Signed-off-by: Claudio Cambra <claudio.cambra@nextcloud.com>
---

diff --git a/src/gui/folderman.cpp b/src/gui/folderman.cpp
index 412910f94..46e586b89 100644
--- a/src/gui/folderman.cpp
+++ b/src/gui/folderman.cpp
@@ -1488,6 +1488,27 @@ void FolderMan::editFileLocally(const QString &userId, const QString &relPath, c
         return;
     }
 
+    // We want to check that the path is canonical and not relative
+    // (i.e. that it doesn't contain ../../) but we always receive
+    // a relative path, so let's make it absolute by prepending a
+    // slash
+
+    auto slashPrefixedPath = relPath;
+    if (!slashPrefixedPath.startsWith('/')) {
+        slashPrefixedPath.prepend('/');
+    }
+
+    // Let's check that the filepath is canonical, and that the request
+    // contains no funny behaviour regarding paths
+    const auto cleanedPath = QDir::cleanPath(slashPrefixedPath);
+
+    if (cleanedPath != slashPrefixedPath) {
+        qCWarning(lcFolderMan) << "Provided relPath was:" << relPath
+                               << "which is not canonical (cleaned path was:" << cleanedPath << ")";
+        showError(accountFound, tr("Invalid file path was provided."), tr("Please try again."));
+        return;
+    }
+
     const auto foundFiles = findFileInLocalFolders(relPath, accountFound->account());
 
     if (foundFiles.isEmpty()) {