anotherim/anotherim-desktop
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Fix file traversal issue on incoming file transfers

Browse source 
Fixes CVE-2021-33896
This commit is contained in:
fiaxh 2021-06-07 09:56:25 -06:00
parent 1ac16ecd84
commit 0c8d25b7a3
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
libdino/src/entity/file_transfer.vala
View file

@ -45,7 +45,18 @@ public class FileTransfer : Object {
} }
} }
public string file_name { get; set; } private string file_name_;
public string file_name {
get { return file_name_; }
set {
file_name_ = Path.get_basename(value);
if (file_name_ == Path.DIR_SEPARATOR_S || file_name_ == ".") {
file_name_ = "unknown filename";
} else if (file_name_.has_prefix(".")) {
file_name_ = "_" + file_name_;
}
}
}
private string? server_file_name_ = null; private string? server_file_name_ = null;
public string server_file_name { public string server_file_name {
get { return server_file_name_ ?? file_name; } get { return server_file_name_ ?? file_name; }