Union/ProjectLighthouse
1
0
Fork 0
mirror of https://github.com/LBPUnion/ProjectLighthouse.git synced 2025-05-15 06:02:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Prevent directory traversal attacks

Browse source
This commit is contained in:
Slendy 2022-09-22 17:11:17 -05:00
parent b26d96bacd
commit 2cf2e6622a
No known key found for this signature in database
GPG key ID: 7288D68361B91428
3 changed files with 20 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

19
ProjectLighthouse.Servers.Website/Controllers/ResourcesController.cs
View file

@ -11,18 +11,19 @@ public class ResourcesController : ControllerBase
[HttpGet("/gameAssets/{hash}")]
public IActionResult GetGameImage(string hash)
{
string path = Path.Combine("png", $"{hash}.png");
string path = FileHelper.GetImagePath($"{hash}.png");
if (IOFile.Exists(path))
{
return this.File(IOFile.OpenRead(path), "image/png");
}
string fullPath = Path.GetFullPath(path);
string basePath = Path.GetFullPath(FileHelper.ImagePath);
// Prevent directory traversal attacks
if (!fullPath.StartsWith(basePath)) return this.BadRequest();
if (IOFile.Exists(path)) return this.File(IOFile.OpenRead(path), "image/png");
LbpFile? file = LbpFile.FromHash(hash);
if (file != null && FileHelper.LbpFileToPNG(file))
{
return this.File(IOFile.OpenRead(path), "image/png");
}
if (file != null && FileHelper.LbpFileToPNG(file)) return this.File(IOFile.OpenRead(path), "image/png");
return this.NotFound();
}
}