Skip to content

Commit 65b98c7

Browse files
claudiamurialdoBeta Bot
authored andcommitted
Cherry pick branch 'genexuslabs:fix/crop-scale-signed-url-filename' into beta
1 parent 99c2b8a commit 65b98c7

1 file changed

Lines changed: 6 additions & 2 deletions

File tree

dotnet/test/DotNetUnitTest/FileIO/FileIOTests.cs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,15 +87,19 @@ public void GXDBFilePathTest()
8787
"content%5c..%5c..%5c..%5cdocument.aspx","content%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cdocument.aspx","content%255c..%255c..%255c..%255cdocument.aspx",
8888
"content%c0%af..%c0%af..%c0%af..%c0%afdocument.aspx","content%c1%9c..%c1%9c..%c1%9c..%c1%9cdocument.aspx"};
8989

90+
string safeResolved = GXDbFile.ResolveUri($"{GXDbFile.Scheme}:safe.txt", false);
91+
string safeResolvedPath = Uri.TryCreate(safeResolved, UriKind.Absolute, out Uri safeUri) && safeUri.IsFile
92+
? safeUri.LocalPath
93+
: safeResolved;
94+
string fullBase = Path.GetDirectoryName(Path.GetFullPath(safeResolvedPath)) + Path.DirectorySeparatorChar;
95+
9096
foreach (string fileName in filesName)
9197
{
9298
string newFileName = GXDbFile.ResolveUri($"{GXDbFile.Scheme}:{fileName}", false);
93-
string baseDir = Preferences.getBLOB_PATH();
9499
string resolvedPath = Uri.TryCreate(newFileName, UriKind.Absolute, out Uri parsedUri) && parsedUri.IsFile
95100
? parsedUri.LocalPath
96101
: newFileName;
97102
string fullResolved = Path.GetFullPath(resolvedPath);
98-
string fullBase = Path.GetFullPath(baseDir);
99103
bool isOK = fullResolved.StartsWith(fullBase, StringComparison.OrdinalIgnoreCase);
100104
Assert.True(isOK, $"Path traversal detected: resolved '{fullResolved}' is outside base '{fullBase}' for input '{fileName}'");
101105
}

0 commit comments

Comments
 (0)