From 0135b3560c1760cf582db0a040c7f2e0f93810a6 Mon Sep 17 00:00:00 2001 From: advplyr Date: Tue, 10 Jun 2025 17:02:42 -0500 Subject: [PATCH] Fix filesystem pathexists path join --- server/controllers/FileSystemController.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/controllers/FileSystemController.js b/server/controllers/FileSystemController.js index 7629f9ee..edfd869c 100644 --- a/server/controllers/FileSystemController.js +++ b/server/controllers/FileSystemController.js @@ -89,7 +89,6 @@ class FileSystemController { } const { directory, folderPath } = req.body - if (!directory?.length || typeof directory !== 'string' || !folderPath?.length || typeof folderPath !== 'string') { Logger.error(`[FileSystemController] Invalid request body: ${JSON.stringify(req.body)}`) return res.status(400).json({ @@ -109,7 +108,8 @@ class FileSystemController { return res.sendStatus(404) } - const filepath = Path.posix.join(libraryFolder.path, directory) + const filepath = Path.join(libraryFolder.path, directory) + // Ensure filepath is inside library folder (prevents directory traversal) if (!filepath.startsWith(libraryFolder.path)) { Logger.error(`[FileSystemController] Filepath is not inside library folder: ${filepath}`)