Sanitize file path input to prevent directory traversal

1 files changed, 21 insertions, 0 deletions

diff --git a/hotline/file_path.go b/hotline/file_path.go
index d6c05bc..2e2e085 100644
--- a/hotline/file_path.go
+++ b/hotline/file_path.go
@@ -32,6 +32,9 @@ type FilePath struct {
 
 const minFilePathLen = 2
 func (fp *FilePath) UnmarshalBinary(b []byte) error {
+	if b == nil {
+		return nil
+	}
 	if len(b) < minFilePathLen {
 		return errors.New("insufficient bytes")
 	}
@@ -71,3 +74,21 @@ func ReadFilePath(filePathFieldData []byte) string {
 	}
 	return fp.String()
 }
+
+func readPath(fileRoot string, filePath, fileName []byte) (fullPath string, err error) {
+	var fp FilePath
+	if filePath != nil {
+		if err = fp.UnmarshalBinary(filePath); err != nil {
+			return "", err
+		}
+	}
+
+	fullPath = path.Join(
+		"/",
+		fileRoot,
+		fp.String(),
+		path.Join("/", string(fileName)),
+	)
+
+	return fullPath, nil
+}