mirror of
https://github.com/filebrowser/filebrowser.git
synced 2026-07-17 16:36:49 +00:00
847d08bdd1
- http/raw.go: strip Windows backslash separators from archive entry names on any host. filepath.ToSlash is a no-op for "\" on Linux, so a stored backslash filename was emitted verbatim and could escape the extraction directory on Windows extractors (zip-slip). (GHSA-gxjx-7m74-hcq8) - http/auth.go: cap the login and signup request bodies with http.MaxBytesReader (1 MiB). The JSON decoder previously read an arbitrarily large password into memory before bcrypt truncated it, enabling unauthenticated memory-exhaustion DoS. (GHSA-w5fm-68j4-fpc4) - files/file.go, http/resource.go: add files.WithinScope and refuse to follow a symlink whose on-disk target escapes the user's scoped root, on both the read path (stat) and the write path (writeFile). Prevents a scoped user from reading/overwriting/sharing files outside their scope via a pre-existing escaping symlink. (GHSA-239w-m3h6-ch8v) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| auth.go | ||
| commands.go | ||
| data.go | ||
| headers.go | ||
| http.go | ||
| preview.go | ||
| preview_enum.go | ||
| public.go | ||
| public_test.go | ||
| raw.go | ||
| raw_test.go | ||
| resource.go | ||
| search.go | ||
| settings.go | ||
| share.go | ||
| static.go | ||
| subtitle.go | ||
| tus_handlers.go | ||
| upload_cache_memory.go | ||
| upload_cache_redis.go | ||
| users.go | ||
| utils.go | ||