CodeCow/alist
1
0
Fork 0
mirror of https://github.com/alist-org/alist.git synced 2026-07-21 21:14:07 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #9566 from orbisai0security/fix-v-001-sanitize-filepath-metacharacters

Browse Source 
fix: sanitize shell/subprocess call in util.go
This commit is contained in:
千石 2026-07-06 21:01:12 +08:00 committed by GitHub
commit cdeed27412
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/local/util.go
View File

@ -49,6 +49,9 @@ func sanitizeFilePath(path string) (string, error) {
if !filepath.IsAbs(cleaned) {
return "", fmt.Errorf("file path must be absolute: %s", path)
}
if strings.ContainsAny(cleaned, ";&|`$<>!\n\r\x00") {
return "", fmt.Errorf("file path contains invalid characters: %s", path)
}
info, err := os.Stat(cleaned)
if err != nil {
return "", fmt.Errorf("file path is not accessible: %w", err)