Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] print client shoud send file basename instead of the relative path #2885

Open
cubercsl opened this issue Dec 24, 2024 · 1 comment
Open
Assignees

Comments

@cubercsl
Copy link
Contributor

cubercsl commented Dec 24, 2024

Description of the problem

The printing API added in 68c297e should also validate the originalName.

Print client should send file basename instead of the relative path.

Previously, the originalName was taken from the upload form, but now the user is free to enter it, which may affect some printing backend.

Your environment

DOMJudge master

@Kevinjil Kevinjil self-assigned this Dec 24, 2024
@Kevinjil
Copy link
Contributor

Kevinjil commented Jan 28, 2025

I rechecked the code, and this is not a bug. The orignalName was never safe to use without sanitation in the print backend.

Quoting the Symfony docs:

Using the original name via getClientOriginalName() or getClientOriginalPath is not safe as it could have been manipulated by the end-user. Moreover, it can contain characters that are not allowed in file names. You should sanitize the value before using it directly.

I think it should explicitly not be a basename to allow teams to see which path they sent to the printer. If the printing backend expects a basename, it should sanitize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants