You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I rechecked the code, and this is not a bug. The orignalName was never safe to use without sanitation in the print backend.
Quoting the Symfony docs:
Using the original name via getClientOriginalName() or getClientOriginalPath is not safe as it could have been manipulated by the end-user. Moreover, it can contain characters that are not allowed in file names. You should sanitize the value before using it directly.
I think it should explicitly not be a basename to allow teams to see which path they sent to the printer. If the printing backend expects a basename, it should sanitize it.
Description of the problem
The printing API added in 68c297e should also validate the
originalName
.Print client should send file basename instead of the relative path.
Previously, the
originalName
was taken from the upload form, but now the user is free to enter it, which may affect some printing backend.Your environment
DOMJudge master
The text was updated successfully, but these errors were encountered: