security: prevent file traversal in uploads

2026-04-19 06:06:01 +00:00 · 2025-06-12 10:43:27 +02:00
parent c34f2d4da7
commit 18b11df672
1 changed files with 4 additions and 0 deletions
--- a/packages/api/src/controllers/uploads.js
+++ b/packages/api/src/controllers/uploads.js
@@ -44,6 +44,10 @@ module.exports = {
    raw: true,
  },
  get(req, res) {
+    if (req.query.file.includes('..') || req.query.file.includes('/') || req.query.file.includes('\\')) {
+      res.status(400).send('Invalid file path');
+      return;
+    }
    res.sendFile(path.join(uploadsdir(), req.query.file));
  },