Просмотр исходного кода

fix "Uncontrolled data used in path expression" CodeQL error

Futa Arai 6 месяцев назад
Родитель
Сommit
af76763161

+ 9 - 7
apps/app/src/features/growi-plugin/server/services/growi-plugin/growi-plugin.ts

@@ -155,16 +155,18 @@ export class GrowiPluginService implements IGrowiPluginService {
 
     const installedPath = `${organizationName}/${reposName}`;
 
-    const organizationPath = path.join(PLUGIN_STORING_PATH, organizationName);
-    const zipFilePath = path.join(
-      organizationPath,
+    const organizationPath = this.joinAndValidatePath(PLUGIN_STORING_PATH, organizationName);
+    const zipFilePath = this.joinAndValidatePath(
+      PLUGIN_STORING_PATH,
+      organizationName,
       `${reposName}-${extractedArchiveDirName}.zip`,
     );
-    const temporaryReposPath = path.join(
-      organizationPath,
+    const temporaryReposPath = this.joinAndValidatePath(
+      PLUGIN_STORING_PATH,
+      organizationName,
       `${reposName}-${extractedArchiveDirName}`,
     );
-    const reposPath = path.join(organizationPath, reposName);
+    const reposPath = this.joinAndValidatePath(PLUGIN_STORING_PATH, organizationName, reposName);
 
     if (!fs.existsSync(organizationPath)) fs.mkdirSync(organizationPath);
 
@@ -485,7 +487,7 @@ export class GrowiPluginService implements IGrowiPluginService {
   private joinAndValidatePath(
     baseDir: string,
     ...paths: string[]
-  ): fs.PathLike {
+  ): string {
     const joinedPath = path.join(baseDir, ...paths);
     if (!joinedPath.startsWith(baseDir)) {
       throw new Error(