From 621db20dde1a11167430ca4a93b67e256a39b2f0 Mon Sep 17 00:00:00 2001 From: David Cook Date: Thu, 9 Nov 2023 00:49:54 +0000 Subject: [PATCH] Bug 35291: Validate filepaths in linking files Validate that the files in linking files are contained within the ZIP. Signed-off-by: Nick Clemens Signed-off-by: Aleisha Amohia --- tools/upload-cover-image.pl | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tools/upload-cover-image.pl b/tools/upload-cover-image.pl index bf43928b582..7ddd13adbcc 100755 --- a/tools/upload-cover-image.pl +++ b/tools/upload-cover-image.pl @@ -38,6 +38,7 @@ resized, maintaining aspect ratio. =cut use Modern::Perl; +use Cwd; use File::Temp; use CGI qw ( -utf8 ); @@ -187,7 +188,11 @@ if ($fileID) { $filename =~ s/[\"\r\n]//g; $filename =~ s/^\s+//; $filename =~ s/\s+$//; - my $srcimage = GD::Image->new("$dir/$filename"); + my $full_filename = Cwd::abs_path("$dir/$filename"); #Resolve any relative filepath references + my $srcimage; + if ( $full_filename =~ /^\Q$dir\E/ ){ + $srcimage = GD::Image->new($full_filename); + } my $biblio; my $item; if ( defined $srcimage ) { -- 2.30.2