zamis 5 лет назад
Родитель
Сommit
59d6b3e65e
3 измененных файлов с 3 добавлено и 3 удалено
  1. 1 1
      src/server/routes/admin.js
  2. 1 1
      src/server/routes/apiv3/export.js
  3. 1 1
      src/server/service/import.js

+ 1 - 1
src/server/routes/admin.js

@@ -325,7 +325,7 @@ module.exports = function(crowi, app) {
 
 
   api.validators.export.download = function() {
   api.validators.export.download = function() {
     const validator = [
     const validator = [
-      // https://regex101.com/r/mD4eZs/4
+      // https://regex101.com/r/mD4eZs/6
       // prevent from pass traversal attack
       // prevent from pass traversal attack
       param('fileName').not().matches(/(\.\.\/|\.\.\\)/),
       param('fileName').not().matches(/(\.\.\/|\.\.\\)/),
     ];
     ];

+ 1 - 1
src/server/routes/apiv3/export.js

@@ -62,7 +62,7 @@ module.exports = (crowi) => {
 
 
   const validator = {
   const validator = {
     deleteFile: [
     deleteFile: [
-      // https://regex101.com/r/mD4eZs/4
+      // https://regex101.com/r/mD4eZs/6
       // prevent from unexpecting attack doing delete file (path traversal attack)
       // prevent from unexpecting attack doing delete file (path traversal attack)
       param('fileName').not().matches(/(\.\.\/|\.\.\\)/),
       param('fileName').not().matches(/(\.\.\/|\.\.\\)/),
     ],
     ],

+ 1 - 1
src/server/service/import.js

@@ -369,7 +369,7 @@ class ImportService {
 
 
     unzipStream.on('entry', (entry) => {
     unzipStream.on('entry', (entry) => {
       const fileName = entry.path;
       const fileName = entry.path;
-      // https://regex101.com/r/mD4eZs/4
+      // https://regex101.com/r/mD4eZs/6
       // prevent from unexpecting attack doing unzip file (path traversal attack)
       // prevent from unexpecting attack doing unzip file (path traversal attack)
       // FOR EXAMPLE
       // FOR EXAMPLE
       // ../../src/server/views/admin/markdown.html
       // ../../src/server/views/admin/markdown.html