From 231cd55bf504f2d96abf2fc60190940b305f0ece Mon Sep 17 00:00:00 2001 From: wuchunbo Date: Fri, 22 Apr 2022 19:38:53 +0800 Subject: [PATCH] add filepath checking Signed-off-by: wuchunbo --- .../include/legacy/download_manager.h | 2 ++ .../src/legacy/download_manager.cpp | 25 +++++++++++++++++++ .../src/legacy/download_task.cpp | 1 - 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/download/interfaces/kits/js/napi/download_single/include/legacy/download_manager.h b/download/interfaces/kits/js/napi/download_single/include/legacy/download_manager.h index c7ec8a6..16571ee 100644 --- a/download/interfaces/kits/js/napi/download_single/include/legacy/download_manager.h +++ b/download/interfaces/kits/js/napi/download_single/include/legacy/download_manager.h @@ -59,6 +59,8 @@ private: static std::string GetFilenameFromUrl(std::string &url); + static bool IsPathValid(const std::string& dir, const std::string& filename); + static std::vector ParseHeader(napi_env env, napi_value option); static DownloadTask::DownloadOption ParseOption(napi_env env, napi_value option); diff --git a/download/interfaces/kits/js/napi/download_single/src/legacy/download_manager.cpp b/download/interfaces/kits/js/napi/download_single/src/legacy/download_manager.cpp index 2cde1d7..690630c 100644 --- a/download/interfaces/kits/js/napi/download_single/src/legacy/download_manager.cpp +++ b/download/interfaces/kits/js/napi/download_single/src/legacy/download_manager.cpp @@ -14,6 +14,8 @@ */ #include "legacy/download_manager.h" +#include +#include #include "legacy/download_task.h" #include "ability.h" #include "napi_base_context.h" @@ -173,6 +175,17 @@ DownloadTask::DownloadOption DownloadManager::ParseOption(napi_env env, napi_val return downloadOption; } +bool DownloadManager::IsPathValid(const std::string &dir, const std::string &filename) +{ + auto filepath = dir + '/' + filename; + char path[PATH_MAX]; + if (realpath(filepath.c_str(), path) && !strncmp(path, dir.c_str(), dir.length())) { + return true; + } + DOWNLOAD_HILOGE("file path is invalid"); + return false; +} + napi_value DownloadManager::Download(napi_env env, napi_callback_info info) { size_t argc = DOWNLOAD_ARGC; @@ -181,6 +194,18 @@ napi_value DownloadManager::Download(napi_env env, napi_callback_info info) napi_value res = NapiUtils::GetUndefined(env); auto option = ParseOption(env, argv[0]); + if (!IsPathValid(option.fileDir_, option.filename_)) { + auto callback = NapiUtils::GetNamedProperty(env, argv[0], "fail"); + if (callback != nullptr) { + DOWNLOAD_HILOGI("call fail of download"); + napi_value result[FAIL_CB_ARGC] {}; + result[0] = NapiUtils::CreateStringUtf8(env, "invalid file name"); + result[1] = NapiUtils::CreateInt32(env, FAIL_CB_DOWNLOAD_ERROR); + NapiUtils::CallFunction(env, argv[0], callback, FAIL_CB_ARGC, result); + } + return res; + } + auto token = GetTaskToken(); auto* task = new(std::nothrow) DownloadTask(token, option, OnTaskDone); if (task == nullptr) { diff --git a/download/interfaces/kits/js/napi/download_single/src/legacy/download_task.cpp b/download/interfaces/kits/js/napi/download_single/src/legacy/download_task.cpp index 3c9feea..318e9cd 100644 --- a/download/interfaces/kits/js/napi/download_single/src/legacy/download_task.cpp +++ b/download/interfaces/kits/js/napi/download_single/src/legacy/download_task.cpp @@ -72,7 +72,6 @@ bool DownloadTask::SetOption(CURL *handle, curl_slist *&headers) if (!option_.header_.empty()) { for (const auto& head : option_.header_) { - DOWNLOAD_HILOGD("%{public}s", head.c_str()); headers = curl_slist_append(headers, head.c_str()); } curl_easy_setopt(handle, CURLOPT_HTTPHEADER, headers);