diff --git a/extra/admin-api/Interop/Spacebar.Interop.Cdn.Abstractions/FilesystemFileSource.cs b/extra/admin-api/Interop/Spacebar.Interop.Cdn.Abstractions/FilesystemFileSource.cs
index a3f0a7d8..8a67dfe3 100644
--- a/extra/admin-api/Interop/Spacebar.Interop.Cdn.Abstractions/FilesystemFileSource.cs
+++ b/extra/admin-api/Interop/Spacebar.Interop.Cdn.Abstractions/FilesystemFileSource.cs
@@ -1,20 +1,27 @@
-using ArcaneLibs;
-
namespace Spacebar.Interop.Cdn.Abstractions;
public class FilesystemFileSource(string baseUrl) : IFileSource {
public string BaseUrl => baseUrl;
- public async Task Init(CancellationToken? cancellationToken = null) {
+ private string GetPathSafe(string path) {
+ var p = Path.Join(baseUrl, path);
+ if (!p.StartsWith(baseUrl)) throw new UnauthorizedAccessException("Invalid path: " + p);
+ Console.WriteLine($"Resolved \"safe\" path: {p}");
+ return p;
+ }
+
+ public async Task<IFileSource> Init(CancellationToken? cancellationToken = null) {
foreach (var dir in new[] { "avatars", "banners", "icons", "stickers", "emojis" }) {
var fullPath = Path.Join(baseUrl, dir);
if (!Directory.Exists(fullPath))
Directory.CreateDirectory(fullPath);
}
+
+ return this;
}
public async Task<FileInfo> GetFile(string path, CancellationToken? cancellationToken = null) {
- await using var rs = File.OpenRead(Path.Join(baseUrl, path));
+ await using var rs = File.OpenRead(GetPathSafe(path));
var ms = new MemoryStream();
await rs.CopyToAsync(ms);
return new() {
@@ -24,11 +31,11 @@ public class FilesystemFileSource(string baseUrl) : IFileSource {
}
public Task<bool> FileExists(string path, CancellationToken? cancellationToken = null) {
- return Task.FromResult(File.Exists(Path.Join(baseUrl, path)));
+ return Task.FromResult(File.Exists(GetPathSafe(path)));
}
public async Task WriteFile(string path, Stream stream) {
- var fullPath = Path.Join(baseUrl, path);
+ var fullPath = GetPathSafe(path);
// Console.WriteLine($"Writing file to {fullPath}... ");
if (!Directory.Exists(Path.GetDirectoryName(fullPath)!))
Directory.CreateDirectory(Path.GetDirectoryName(fullPath)!);
@@ -43,6 +50,6 @@ public class FilesystemFileSource(string baseUrl) : IFileSource {
// return Mimes.GetMime(mic.First().Format);
// }
public Task<bool> DirectoryExists(string path) {
- return Task.FromResult(Directory.Exists(Path.Join(baseUrl, path)));
+ return Task.FromResult(Directory.Exists(GetPathSafe(path)));
}
}
\ No newline at end of file
|
