Jelajahi Sumber

fix unzipstream filename

zamis 5 tahun lalu
induk
melakukan
5d5f349e19
1 mengubah file dengan 2 tambahan dan 2 penghapusan
  1. 2 2
      src/server/service/import.js

+ 2 - 2
src/server/service/import.js

@@ -369,11 +369,11 @@ class ImportService {
 
 
     unzipStream.on('entry', (entry) => {
     unzipStream.on('entry', (entry) => {
       const fileName = entry.path;
       const fileName = entry.path;
-      // https://regex101.com/r/mD4eZs/3
+      // https://regex101.com/r/mD4eZs/4
       // prevent from unexpecting attack doing unzip file (path traversal attack)
       // prevent from unexpecting attack doing unzip file (path traversal attack)
       // FOR EXAMPLE
       // FOR EXAMPLE
       // ../../src/server/views/admin/markdown.html
       // ../../src/server/views/admin/markdown.html
-      if (fileName.match(/(\.\.\/|\.\.\\)/g)) {
+      if (fileName.match(/(\.\.\/|\.\.\\)/)) {
         logger.error('File path is not appropriate.', fileName);
         logger.error('File path is not appropriate.', fileName);
         return;
         return;
       }
       }