fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

filehost: use only the final path segment of the URL as the displayed filename tag — the trailing part was taken verbatim (path separators, ../), and while json_esc/escape_tag block injection, a client rendering filename could be misled by traversal; take the basename

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-19 01:32:17 +00:00
parent c532828aab
commit 303fc0c8dc
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/modules/filehost.rs
View file

@ -129,7 +129,10 @@ impl Module for FileHost {
let rest = &text[pos..]; let rest = &text[pos..];
let end = rest.find(|c: char| c.is_whitespace()).unwrap_or(rest.len()); let end = rest.find(|c: char| c.is_whitespace()).unwrap_or(rest.len());
let url = rest[..end].trim_end_matches([',', '.', ';', ':', '!', '?', ')', ']', '}']); let url = rest[..end].trim_end_matches([',', '.', ';', ':', '!', '?', ')', ']', '}']);
let filename = &url[files_prefix.len().min(url.len())..]; let raw_name = &url[files_prefix.len().min(url.len())..];
// display only the final path segment, so a `../` or nested path in the URL
// can't mislead a client that renders the filename tag
let filename = raw_name.rsplit(['/', '\\']).next().unwrap_or(raw_name);
let meta = format!( let meta = format!(
"{{\"url\":\"{}\",\"filename\":\"{}\",\"type\":\"{}\"}}", "{{\"url\":\"{}\",\"filename\":\"{}\",\"type\":\"{}\"}}",
json_esc(url), json_esc(url),