浏览代码

fix unzipstream filename

zamis 5 年之前
父节点
当前提交
5d5f349e19
共有 1 个文件被更改,包括 2 次插入2 次删除
  1. 2 2
      src/server/service/import.js

+ 2 - 2
src/server/service/import.js

@@ -369,11 +369,11 @@ class ImportService {
 
     unzipStream.on('entry', (entry) => {
       const fileName = entry.path;
-      // https://regex101.com/r/mD4eZs/3
+      // https://regex101.com/r/mD4eZs/4
       // prevent from unexpecting attack doing unzip file (path traversal attack)
       // FOR EXAMPLE
       // ../../src/server/views/admin/markdown.html
-      if (fileName.match(/(\.\.\/|\.\.\\)/g)) {
+      if (fileName.match(/(\.\.\/|\.\.\\)/)) {
         logger.error('File path is not appropriate.', fileName);
         return;
       }