Ryan/docmost
1
0
Fork 0
mirror of https://github.com/docmost/docmost.git synced 2025-11-10 08:22:07 +10:00
Code Issues Packages Projects Releases Wiki Activity

fix: validate public avatar path (#1416)

Browse Source
This commit is contained in:
Philip Okugbe
2025-07-28 18:17:06 +01:00
committed by GitHub
parent 0bd7ecb9b0
commit 78bce0e29d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/server/src/core/attachment/attachment.controller.ts
View File

@ -50,6 +50,7 @@ import { validate as isValidUUID } from 'uuid';
import { EnvironmentService } from '../../integrations/environment/environment.service';
import { TokenService } from '../auth/services/token.service';
import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
import * as path from 'path';
@Controller()
export class AttachmentController {
@ -356,6 +357,11 @@ export class AttachmentController {
throw new BadRequestException('Invalid image attachment type');
}
const filenameWithoutExt = path.basename(fileName, path.extname(fileName));
if (!isValidUUID(filenameWithoutExt)) {
throw new BadRequestException('Invalid file id');
}
const filePath = `${getAttachmentFolderPath(attachmentType, workspace.id)}/${fileName}`;
try {