gian/cubefs
1
0
Fork 0
mirror of https://github.com/cubefs/cubefs.git synced 2026-08-02 02:00:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(sdk): fix Uncontrolled data used in network request

Browse Source 
Signed-off-by: baihailong <baihailong@oppo.com>
This commit is contained in:
baihailong 2024-08-12 11:01:18 +08:00 committed by leonrayang
parent dd741df686
commit 4a87988bf7
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
console/service/file.go
View File

@ -5,6 +5,7 @@ import (
"encoding/json" "encoding/json"
"fmt" "fmt"
"net/http" "net/http"
"regexp"
"strconv" "strconv"
"strings" "strings"
"time" "time"
@ -23,6 +24,8 @@ import (
"github.com/samsarahq/thunder/graphql/schemabuilder" "github.com/samsarahq/thunder/graphql/schemabuilder"
) )
var volNameRegexp = regexp.MustCompile("^[a-zA-Z0-9][a-zA-Z0-9_.-]{1,61}[a-zA-Z0-9]$")
type FileService struct { type FileService struct {
userClient *user.UserClient userClient *user.UserClient
manager *VolumeManager manager *VolumeManager
@ -307,6 +310,11 @@ func (fs *FileService) DownFile(writer http.ResponseWriter, request *http.Reques
return fmt.Errorf("not found path in get param ?vol_name=[your path]") return fmt.Errorf("not found path in get param ?vol_name=[your path]")
} }
// check volName
if !volNameRegexp.MatchString(volName) {
return fmt.Errorf("name can only be number and letters")
}
// author validate // author validate
if err := fs.userVolPerm(ctx, info.User_id, volName).read(); err != nil { if err := fs.userVolPerm(ctx, info.User_id, volName).read(); err != nil {
return fmt.Errorf("the user does not have permission to access this volume") return fmt.Errorf("the user does not have permission to access this volume")