From 92a7e455a347e5be7fb69b6846b9f27ca698ae12 Mon Sep 17 00:00:00 2001
From: Jeff Halter <868228+jhalter@users.noreply.github.com>
Date: Sun, 30 Jan 2022 20:56:04 -0800
Subject: Sanitize file path input to prevent directory traversal

---
 hotline/flattened_file_object.go | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'hotline/flattened_file_object.go')

diff --git a/hotline/flattened_file_object.go b/hotline/flattened_file_object.go
index 656cdd3..02804f6 100644
--- a/hotline/flattened_file_object.go
+++ b/hotline/flattened_file_object.go
@@ -2,7 +2,6 @@ package hotline
 
 import (
 	"encoding/binary"
-	"fmt"
 	"os"
 )
 
@@ -197,8 +196,12 @@ func (f flattenedFileObject) BinaryMarshal() []byte {
 	return out
 }
 
-func NewFlattenedFileObject(filePath, fileName string) (*flattenedFileObject, error) {
-	file, err := os.Open(fmt.Sprintf("%v/%v", filePath, fileName))
+func NewFlattenedFileObject(fileRoot string, filePath, fileName []byte) (*flattenedFileObject, error) {
+	fullFilePath, err := readPath(fileRoot, filePath, fileName)
+	if err != nil {
+		return nil, err
+	}
+	file, err := os.Open(fullFilePath)
 	if err != nil {
 		return nil, err
 	}
@@ -214,7 +217,7 @@ func NewFlattenedFileObject(filePath, fileName string) (*flattenedFileObject, er
 
 	return &flattenedFileObject{
 		FlatFileHeader:          NewFlatFileHeader(),
-		FlatFileInformationFork: NewFlatFileInformationFork(fileName),
+		FlatFileInformationFork: NewFlatFileInformationFork(string(fileName)),
 		FlatFileDataForkHeader: FlatFileDataForkHeader{
 			ForkType:        []byte("DATA"),
 			CompressionType: []byte{0, 0, 0, 0},
-- 
cgit