Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐛 Uncontrolled data used in path expression #11821

Closed
xuxiaowei-com-cn opened this issue Mar 13, 2024 · 0 comments
Closed

🐛 Uncontrolled data used in path expression #11821

xuxiaowei-com-cn opened this issue Mar 13, 2024 · 0 comments

Comments

@xuxiaowei-com-cn
Copy link
Contributor

Describe the bug
Uncontrolled data used in path expression
确保文件名没有路径分隔符或父目录引用

Expected behavior
ensure that the filename has no path separators or parent directory references
确保文件名没有路径分隔符或父目录引用

Actually behavior
If parameter language contains . or /, it may affect system security
参数 language 如果包含 . 或者 / 可能影响系统安全

How to Reproduce
Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See errors

Desktop (please complete the following information):

  • OS: [e.g. Centos]
    • any
  • Version [e.g. nacos-server 1.3.1, nacos-client 1.3.1]
    • 2.3.1
  • Module [e.g. naming/config]
    • console
  • SDK [e.g. original, spring-cloud-alibaba-nacos, dubbo]

Additional context

https://github.com/alibaba/nacos/blob/2.3.1/console/src/main/java/com/alibaba/nacos/console/controller/ServerStateController.java#L65-L75

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants