github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-09-16 02:52:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #19293 from overleaf/jpa-issue-19290-2

Browse source 
[clsi] fix parsing of the requested file in symlink validation

GitOrigin-RevId: 86cfe8d62bb99ed6844faee0ff4af507e571e04d
This commit is contained in:
Jakob Ackermann 2024-07-05 18:27:06 +02:00 committed by Copybot
parent 58ffefc8bb
commit 51a24601ec
2 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
services/clsi/app/js/StaticServerForbidSymlinks.js
View file

@ -25,9 +25,13 @@ module.exports = ForbidSymlinks = function (staticFn, root, options) {
let file, projectId, result
const path = req.url
// check that the path is of the form /project_id_or_name/path/to/file.log
if ((result = path.match(/^\/?([a-zA-Z0-9_-]+)\/(.*)/))) {
if ((result = path.match(/^\/([a-zA-Z0-9_-]+)\/(.*)$/s))) {
projectId = result[1]
file = result[2]
if (path !== `/${projectId}/${file}`) {
logger.warn({ path }, 'unrecognized file request')
return res.sendStatus(404)
}
} else {
logger.warn({ path }, 'unrecognized file request')
return res.sendStatus(404)

17
services/clsi/test/unit/js/StaticServerForbidSymlinksTests.js
View file

@ -94,6 +94,23 @@ describe('StaticServerForbidSymlinks', function () {
})
})
describe('with a new line', function () {
beforeEach(function () {
this.req.url = '/12345/output.pdf\nother file'
this.fs.realpath = sinon.stub().yields()
})
it('should process the correct file', function (done) {
this.res.sendStatus = () => {
this.fs.realpath.should.have.been.calledWith(
`${this.settings.path.compilesDir}/12345/output.pdf\nother file`
)
done()
}
this.StaticServerForbidSymlinks(this.req, this.res)
})
})
describe('with a symlink file', function () {
beforeEach(function () {
return (this.fs.realpath = sinon