From 40f158503cda3ccc665eb7ab02593c6d42e0deb8 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Mon, 6 Sep 2021 10:46:12 +0000 Subject: [PATCH 1/3] Check if SVG path is valid Signed-off-by: Lukas Reschke --- core/Controller/SvgController.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/Controller/SvgController.php b/core/Controller/SvgController.php index 573f245c5a1d1..1a5a547d1403e 100644 --- a/core/Controller/SvgController.php +++ b/core/Controller/SvgController.php @@ -31,6 +31,7 @@ namespace OC\Core\Controller; +use OC\Files\Filesystem; use OC\Template\IconsCacher; use OCP\App\AppPathNotFoundException; use OCP\App\IAppManager; @@ -117,6 +118,10 @@ public function getSvgFromApp(string $app, string $fileName, string $color = 'ff * @return DataDisplayResponse|NotFoundResponse */ private function getSvg(string $path, string $color, string $fileName) { + if(!Filesystem::isValidPath($path)) { + return new NotFoundResponse(); + } + if (!file_exists($path)) { return new NotFoundResponse(); } From 430e286ab6bed45100d855175def245e8fbb2fba Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Mon, 6 Sep 2021 10:53:01 +0000 Subject: [PATCH 2/3] Fix codestyle Signed-off-by: Lukas Reschke --- core/Controller/SvgController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/Controller/SvgController.php b/core/Controller/SvgController.php index 1a5a547d1403e..b5c2008756b04 100644 --- a/core/Controller/SvgController.php +++ b/core/Controller/SvgController.php @@ -118,7 +118,7 @@ public function getSvgFromApp(string $app, string $fileName, string $color = 'ff * @return DataDisplayResponse|NotFoundResponse */ private function getSvg(string $path, string $color, string $fileName) { - if(!Filesystem::isValidPath($path)) { + if (!Filesystem::isValidPath($path)) { return new NotFoundResponse(); } From 89d9dada0f5750edb3327795c47aace979b0629a Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Mon, 6 Sep 2021 21:26:27 +0200 Subject: [PATCH 3/3] Resolve absolute path in tests Signed-off-by: Lukas Reschke --- tests/Core/Controller/SvgControllerTest.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Core/Controller/SvgControllerTest.php b/tests/Core/Controller/SvgControllerTest.php index c8d0ea5f50378..f44440389ff43 100644 --- a/tests/Core/Controller/SvgControllerTest.php +++ b/tests/Core/Controller/SvgControllerTest.php @@ -183,7 +183,7 @@ public function testGetSvgFromApp(string $appName, string $name, string $color, $this->appManager->expects($this->once()) ->method('getAppPath') ->with($appName) - ->willReturn(__DIR__ . '/../../../apps/' . $appName); + ->willReturn(realpath(__DIR__ . '/../../../apps/') . '/' . $appName); $response = $this->svgController->getSvgFromApp($appName, $name, $color);