lzhr/v2fly
1
0
Fork 0
mirror of https://github.com/v2fly/v2ray-core.git synced 2024-12-21 17:46:58 -05:00
Code Issues Releases Wiki Activity

show warning for asset directory transversal to prepare for network api based reload in v5

Browse Source
This commit is contained in:
Shelikhoo 2021-05-05 11:25:50 +01:00
parent 736379d22d
commit a720d1e2d6
No known key found for this signature in database
GPG Key ID: C4D5E79D22B25316
4 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
common/platform/errors.generated.go Normal file
View File

@ -0,0 +1,9 @@
package platform
import "github.com/v2fly/v2ray-core/v4/common/errors"
type errPathObjHolder struct{}
func newError(values ...interface{}) *errors.Error {
return errors.New(values...).WithPathObj(errPathObjHolder{})
}

5
common/platform/others.go
View File

@ -7,6 +7,7 @@ import (
"io/fs"
"os"
"path/filepath"
"strings"
)
func ExpandEnv(s string) string {
@ -25,6 +26,10 @@ func GetToolLocation(file string) string {
// GetAssetLocation search for `file` in certain locations
func GetAssetLocation(file string) string {
filepathCleaned := filepath.Clean(file)
if strings.HasPrefix("..", filepathCleaned) {
newError("directory transversal is not allowed for assets. This will be forbidden in v5.").AtWarning().WriteToLog()
}
const name = "v2ray.location.asset"
assetPath := NewEnvFlag(name).GetValue(getExecutableDir)
defPath := filepath.Join(assetPath, file)

2
common/platform/platform.go
View File

@ -7,6 +7,8 @@ import (
"strings"
)
//go:generate go run github.com/v2fly/v2ray-core/v4/common/errors/errorgen
type EnvFlag struct {
Name string
AltName string

6
common/platform/windows.go
View File

@ -19,8 +19,12 @@ func GetToolLocation(file string) string {
return filepath.Join(toolPath, file+".exe")
}
// GetAssetLocation search for `file` in the excutable dir
// GetAssetLocation search for `file` in the executable dir
func GetAssetLocation(file string) string {
filepathCleaned := filepath.Clean(file)
if strings.HasPrefix("..", filepathCleaned) {
newError("directory transversal is not allowed for assets. This will be forbidden in v5.").AtWarning().WriteToLog()
}
const name = "v2ray.location.asset"
assetPath := NewEnvFlag(name).GetValue(getExecutableDir)
return filepath.Join(assetPath, file)