Sanitize file path input to prevent directory traversal

[rbdr/mobius] / hotline / flattened_file_object.go

diff --git a/hotline/flattened_file_object.go b/hotline/flattened_file_object.go
index dfdd8a871770ce3136f75828a02e8e1efb4f57b1..02804f697f44e62d89cf4f039330672af5ef35f7 100644 (file)
--- a/hotline/flattened_file_object.go
+++ b/hotline/flattened_file_object.go
@@ -2,7 +2,6 @@ package hotline
 
 import (
        "encoding/binary"
 
 import (
        "encoding/binary"

-       "fmt"

        "os"
 )
 
        "os"
 )
 


@@ -16,19 +15,19 @@ type flattenedFileObject struct {
 
 // FlatFileHeader is the first section of a "Flattened File Object".  All fields have static values.
 type FlatFileHeader struct {
 
 // FlatFileHeader is the first section of a "Flattened File Object".  All fields have static values.
 type FlatFileHeader struct {

-       Format    []byte // Always "FILP"
-       Version   []byte // Always 1
-       RSVD      []byte // Always empty zeros
-       ForkCount []byte // Always 2
+       Format    [4]byte  // Always "FILP"
+       Version   [2]byte  // Always 1
+       RSVD      [16]byte // Always empty zeros
+       ForkCount [2]byte  // Always 2

 }
 
 // NewFlatFileHeader returns a FlatFileHeader struct
 func NewFlatFileHeader() FlatFileHeader {
        return FlatFileHeader{
 }
 
 // NewFlatFileHeader returns a FlatFileHeader struct
 func NewFlatFileHeader() FlatFileHeader {
        return FlatFileHeader{

-               Format:    []byte("FILP"),
-               Version:   []byte{0, 1},
-               RSVD:      make([]byte, 16),
-               ForkCount: []byte{0, 2},
+               Format:    [4]byte{0x46, 0x49, 0x4c, 0x50}, // FILP
+               Version:   [2]byte{0, 1},
+               RSVD:      [16]byte{},
+               ForkCount: [2]byte{0, 2},

        }
 }
 
        }
 }
 


@@ -87,7 +86,7 @@ func (ffif FlatFileInformationFork) DataSize() []byte {
 }
 
 func (ffo flattenedFileObject) TransferSize() []byte {
 }
 
 func (ffo flattenedFileObject) TransferSize() []byte {

-       payloadSize := len(ffo.Payload())
+       payloadSize := len(ffo.BinaryMarshal())

        dataSize := binary.BigEndian.Uint32(ffo.FlatFileDataForkHeader.DataSize)
 
        transferSize := make([]byte, 4)
        dataSize := binary.BigEndian.Uint32(ffo.FlatFileDataForkHeader.DataSize)
 
        transferSize := make([]byte, 4)


@@ -110,15 +109,6 @@ type FlatFileDataForkHeader struct {
        DataSize        []byte
 }
 
        DataSize        []byte
 }
 

-func NewFlatFileDataForkHeader() FlatFileDataForkHeader {
-       return FlatFileDataForkHeader{
-               ForkType:        []byte("DATA"),
-               CompressionType: []byte{0, 0, 0, 0},
-               RSVD:            []byte{0, 0, 0, 0},
-               //      DataSize:        []byte{0, 0, 0x03, 0xc3},
-       }
-}
-

 // ReadFlattenedFileObject parses a byte slice into a flattenedFileObject
 func ReadFlattenedFileObject(bytes []byte) flattenedFileObject {
        nameSize := bytes[110:112]
 // ReadFlattenedFileObject parses a byte slice into a flattenedFileObject
 func ReadFlattenedFileObject(bytes []byte) flattenedFileObject {
        nameSize := bytes[110:112]


@@ -138,12 +128,7 @@ func ReadFlattenedFileObject(bytes []byte) flattenedFileObject {
        //dataSize := binary.BigEndian.Uint32(dataSizeField)
 
        ffo := flattenedFileObject{
        //dataSize := binary.BigEndian.Uint32(dataSizeField)
 
        ffo := flattenedFileObject{

-               FlatFileHeader: FlatFileHeader{
-                       Format:    bytes[0:4],
-                       Version:   bytes[4:6],
-                       RSVD:      bytes[6:22],
-                       ForkCount: bytes[22:24],
-               },
+               FlatFileHeader: NewFlatFileHeader(),

                FlatFileInformationForkHeader: FlatFileInformationForkHeader{
                        ForkType:        bytes[24:28],
                        CompressionType: bytes[28:32],
                FlatFileInformationForkHeader: FlatFileInformationForkHeader{
                        ForkType:        bytes[24:28],
                        CompressionType: bytes[28:32],


@@ -176,12 +161,12 @@ func ReadFlattenedFileObject(bytes []byte) flattenedFileObject {
        return ffo
 }
 
        return ffo
 }
 

-func (f flattenedFileObject) Payload() []byte {
+func (f flattenedFileObject) BinaryMarshal() []byte {

        var out []byte
        var out []byte

-       out = append(out, f.FlatFileHeader.Format...)
-       out = append(out, f.FlatFileHeader.Version...)
-       out = append(out, f.FlatFileHeader.RSVD...)
-       out = append(out, f.FlatFileHeader.ForkCount...)
+       out = append(out, f.FlatFileHeader.Format[:]...)
+       out = append(out, f.FlatFileHeader.Version[:]...)
+       out = append(out, f.FlatFileHeader.RSVD[:]...)
+       out = append(out, f.FlatFileHeader.ForkCount[:]...)

 
        out = append(out, []byte("INFO")...)
        out = append(out, []byte{0, 0, 0, 0}...)
 
        out = append(out, []byte("INFO")...)
        out = append(out, []byte{0, 0, 0, 0}...)


@@ -211,24 +196,28 @@ func (f flattenedFileObject) Payload() []byte {
        return out
 }
 
        return out
 }
 

-func NewFlattenedFileObject(filePath string, fileName string) (flattenedFileObject, error) {
-       file, err := os.Open(fmt.Sprintf("%v/%v", filePath, fileName))
+func NewFlattenedFileObject(fileRoot string, filePath, fileName []byte) (*flattenedFileObject, error) {
+       fullFilePath, err := readPath(fileRoot, filePath, fileName)
+       if err != nil {
+               return nil, err
+       }
+       file, err := os.Open(fullFilePath)

        if err != nil {
        if err != nil {

-               return flattenedFileObject{}, err
+               return nil, err

        }
        defer file.Close()
 
        fileInfo, err := file.Stat()
        if err != nil {
        }
        defer file.Close()
 
        fileInfo, err := file.Stat()
        if err != nil {

-               return flattenedFileObject{}, err
+               return nil, err

        }
 
        dataSize := make([]byte, 4)
        binary.BigEndian.PutUint32(dataSize, uint32(fileInfo.Size()))
 
        }
 
        dataSize := make([]byte, 4)
        binary.BigEndian.PutUint32(dataSize, uint32(fileInfo.Size()))
 

-       return flattenedFileObject{
+       return &flattenedFileObject{

                FlatFileHeader:          NewFlatFileHeader(),
                FlatFileHeader:          NewFlatFileHeader(),

-               FlatFileInformationFork: NewFlatFileInformationFork(fileName),
+               FlatFileInformationFork: NewFlatFileInformationFork(string(fileName)),

                FlatFileDataForkHeader: FlatFileDataForkHeader{
                        ForkType:        []byte("DATA"),
                        CompressionType: []byte{0, 0, 0, 0},
                FlatFileDataForkHeader: FlatFileDataForkHeader{
                        ForkType:        []byte("DATA"),
                        CompressionType: []byte{0, 0, 0, 0},