Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hotfix 4144 validate blob #2072

Merged
merged 8 commits into from
Oct 20, 2023
Merged

Hotfix 4144 validate blob #2072

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0191b80
CB-3704. Validate file name
DenisSinelnikov Oct 16, 2023
094eab2
CB-3704. Revert imports
DenisSinelnikov Oct 17, 2023
d762197
Merge remote-tracking branch 'origin/devel' into devel
DenisSinelnikov Oct 17, 2023
7fa8410
Merge branch 'devel' of https://github.com/dbeaver/cloudbeaver into d…
DenisSinelnikov Oct 18, 2023
4f1c738
Merge remote-tracking branch 'origin/devel' into devel
DenisSinelnikov Oct 19, 2023
45a2f10
Merge branch 'devel' of https://github.com/dbeaver/cloudbeaver into d…
DenisSinelnikov Oct 19, 2023
6ad77c6
CB-4144. Fix regex.
DenisSinelnikov Oct 20, 2023
ac7b10b
CB-4144. Fix regex
DenisSinelnikov Oct 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ...bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLFileLoaderServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ public class WebSQLFileLoaderServlet extends WebServiceServletBase {

private static final String FILE_ID = "fileId";

private static final String FORBIDDEN_CHARACTERS_FILE_REGEX = "(?U)[\\w.$()@ -]+";
private static final String FORBIDDEN_CHARACTERS_FILE_REGEX = "(?U)[$()@ /]+";

private static final Gson gson = new GsonBuilder()
.serializeNulls()
Expand Down Expand Up @@ -90,7 +90,7 @@ protected void processServiceRequest(

String fileId = JSONUtils.getString(variables, FILE_ID);

if (fileId != null && !fileId.matches(FORBIDDEN_CHARACTERS_FILE_REGEX)) {
if (fileId != null && !fileId.matches(FORBIDDEN_CHARACTERS_FILE_REGEX) && !fileId.startsWith(".")) {
Path file = tempFolder.resolve(fileId);
try {
Files.write(file, request.getPart("fileData").getInputStream().readAllBytes());
Expand Down
Loading