p15693087
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Island: Add paranoid check to avoid directory traversal attacks

This commit is contained in:
Mike Salvatore 2022-04-26 19:26:27 -04:00
parent 92349d8f8e
commit 8f7215034d
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
monkey/monkey_island/cc/services/directory_file_storage_service.py
View File

@ -45,10 +45,13 @@ class DirectoryFileStorageService(IFileStorageService):
def _get_safe_file_path(self, unsafe_file_name: str):
# Remove any path information from the file name.
safe_file_name = Path(unsafe_file_name).resolve().name
safe_file_path = (self._storage_directory / safe_file_name).resolve()
# TODO: Add super paranoid check
# This is a paranoid check to avoid directory traversal attacks.
if self._storage_directory.resolve() not in safe_file_path.parents:
raise ValueError(f"The file named {unsafe_file_name} can not be safely retrieved")
return self._storage_directory / safe_file_name
return safe_file_path
def delete_all_files(self):
for file in get_all_regular_files_in_directory(self._storage_directory):