lib/model, lib/versioner: Prevent symlink attack via versioning (fixes #4286)
Prior to this, the following is possible: - Create a symlink "foo -> /somewhere", it gets synced - Delete "foo", it gets versioned - Create "foo/bar", it gets synced - Delete "foo/bar", it gets versioned in "/somewhere/bar" With this change, versioners should never version symlinks.
This commit is contained in:
@@ -350,6 +350,24 @@ func (f *fakeConnection) addFile(name string, flags uint32, ftype protocol.FileI
|
||||
f.fileData[name] = data
|
||||
}
|
||||
|
||||
func (f *fakeConnection) deleteFile(name string) {
|
||||
f.mut.Lock()
|
||||
defer f.mut.Unlock()
|
||||
|
||||
for i, fi := range f.files {
|
||||
if fi.Name == name {
|
||||
fi.Deleted = true
|
||||
fi.ModifiedS = time.Now().Unix()
|
||||
fi.Version = fi.Version.Update(f.id.Short())
|
||||
fi.Sequence = time.Now().UnixNano()
|
||||
fi.Blocks = nil
|
||||
|
||||
f.files = append(append(f.files[:i], f.files[i+1:]...), fi)
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (f *fakeConnection) sendIndexUpdate() {
|
||||
f.model.IndexUpdate(f.id, f.folder, f.files)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user