[Koha-bugs] [Bug 6874] File upload in MARC

[bugzilla-daemon at bugs.koha-community.org]

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6874

Frère Sébastien Marie <semarie-koha at latrappe.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|Passed QA                   |Failed QA

--- Comment #34 from Frère Sébastien Marie <semarie-koha at latrappe.fr> ---
I mark the bug "Failed QA" for a security problem (or perhaps two).

in C4/UploadedFiles.pm, sub UploadFile, the regex for sanitize "../" is
invalid.

> if($filename =~ m#/(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) {

for $filename, a "/" was inserted at the beginning... so a filename like
"../foo" is ok. That line should be corrected like:

> if($filename =~ m#(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) { 


And a second (possible) problem is using
> $filename = decode_utf8($filename);
*after* the previous check.

I think it may be possible to pass the "../" check and with decode_utf8 obtain
a "../". To be sure, it should be investigated, but it should be ok to have the
"decode_utf8" *before* the "../" check.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are watching all bug changes.