Sanitize file path input to prevent directory traversal

[rbdr/mobius] / hotline / flattened_file_object.go

diff --git a/hotline/flattened_file_object.go b/hotline/flattened_file_object.go
index 8e2dbff750569e5640a83ad3f495db083abda5e1..02804f697f44e62d89cf4f039330672af5ef35f7 100644 (file)
--- a/hotline/flattened_file_object.go
+++ b/hotline/flattened_file_object.go
@@ -2,7 +2,6 @@ package hotline
 
 import (
        "encoding/binary"
-       "fmt"
        "os"
 )
 
@@ -87,7 +86,7 @@ func (ffif FlatFileInformationFork) DataSize() []byte {
 }
 
 func (ffo flattenedFileObject) TransferSize() []byte {
-       payloadSize := len(ffo.Payload())
+       payloadSize := len(ffo.BinaryMarshal())
        dataSize := binary.BigEndian.Uint32(ffo.FlatFileDataForkHeader.DataSize)
 
        transferSize := make([]byte, 4)
@@ -110,15 +109,6 @@ type FlatFileDataForkHeader struct {
        DataSize        []byte
 }
 
-func NewFlatFileDataForkHeader() FlatFileDataForkHeader {
-       return FlatFileDataForkHeader{
-               ForkType:        []byte("DATA"),
-               CompressionType: []byte{0, 0, 0, 0},
-               RSVD:            []byte{0, 0, 0, 0},
-               //      DataSize:        []byte{0, 0, 0x03, 0xc3},
-       }
-}
-
 // ReadFlattenedFileObject parses a byte slice into a flattenedFileObject
 func ReadFlattenedFileObject(bytes []byte) flattenedFileObject {
        nameSize := bytes[110:112]
@@ -171,7 +161,7 @@ func ReadFlattenedFileObject(bytes []byte) flattenedFileObject {
        return ffo
 }
 
-func (f flattenedFileObject) Payload() []byte {
+func (f flattenedFileObject) BinaryMarshal() []byte {
        var out []byte
        out = append(out, f.FlatFileHeader.Format[:]...)
        out = append(out, f.FlatFileHeader.Version[:]...)
@@ -206,8 +196,12 @@ func (f flattenedFileObject) Payload() []byte {
        return out
 }
 
-func NewFlattenedFileObject(filePath, fileName string) (*flattenedFileObject, error) {
-       file, err := os.Open(fmt.Sprintf("%v/%v", filePath, fileName))
+func NewFlattenedFileObject(fileRoot string, filePath, fileName []byte) (*flattenedFileObject, error) {
+       fullFilePath, err := readPath(fileRoot, filePath, fileName)
+       if err != nil {
+               return nil, err
+       }
+       file, err := os.Open(fullFilePath)
        if err != nil {
                return nil, err
        }
@@ -223,7 +217,7 @@ func NewFlattenedFileObject(filePath, fileName string) (*flattenedFileObject, er
 
        return &flattenedFileObject{
                FlatFileHeader:          NewFlatFileHeader(),
-               FlatFileInformationFork: NewFlatFileInformationFork(fileName),
+               FlatFileInformationFork: NewFlatFileInformationFork(string(fileName)),
                FlatFileDataForkHeader: FlatFileDataForkHeader{
                        ForkType:        []byte("DATA"),
                        CompressionType: []byte{0, 0, 0, 0},