zoriya/flood
1
0
Fork 0
mirror of https://github.com/zoriya/flood.git synced 2026-06-01 10:35:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

server: fileUtil: getDirectoryList: assert typeof inputPath is string

Browse Source
This commit is contained in:
Jesse Chan
2020-10-11 18:14:29 +08:00
parent 720bd5d532
commit 2259ee18d1
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/util/fileUtil.ts
+11 -1
View File
@@ -10,6 +10,12 @@ export const accessDeniedError = () => {
return error;
};
export const fileNotFoundError = () => {
const error = new Error() as NodeJS.ErrnoException;
error.code = 'ENOENT';
return error;
};
export const isAllowedPath = (resolvedPath: string) => {
if (config.allowedPaths == null) {
return true;
@@ -43,7 +49,11 @@ export const createDirectory = (directoryPath: string) => {
};
export const getDirectoryList = async (inputPath: string) => {
const sourcePath = (inputPath || '/').replace(/^~/, homedir());
if (typeof inputPath !== 'string') {
throw fileNotFoundError();
}
const sourcePath = inputPath.replace(/^~/, homedir());
const resolvedPath = sanitizePath(sourcePath);
if (!isAllowedPath(resolvedPath)) {