Experimental patch for #92 v2

src/mod/user/directoryHandler.go

@@ -2,8 +2,10 @@ package user
 
 import (
 	"errors"
+	"log"
 	"os"
 	"path/filepath"
+	"strings"
 
 	fs "imuslab.com/arozos/mod/filesystem"
 )
@@ -85,6 +87,11 @@ func (u *User) VirtualPathToRealPath(vpath string) (string, error) {
 		return "", err
 	}
 
+	if strings.Contains(filepath.Clean(subpath), "..") {
+		log.Println(filepath.Clean(subpath))
+		return "", errors.New("Request path out of storage root")
+	}
+
 	//Look for the handler with the same virtualPath ID
 	for _, storage := range userFsHandlers {
 		if storage.UUID == vid {
@@ -100,6 +107,10 @@ func (u *User) VirtualPathToRealPath(vpath string) (string, error) {
 				return "", errors.New("Request Filesystem Handler do not allow direct access")
 			}
 
+			//A bit hacky to make sure subpath contains no traversal
+			//Will migrate this to File System Vpath Resolver in the next large update
+			subpath = strings.ReplaceAll(subpath, "..", "")
+
 			//Handle general cases
 			if storage.Hierarchy == "user" {
 				return filepath.ToSlash(filepath.Join(filepath.Clean(storage.Path), "/users/", u.Username, subpath)), nil

src/mod/user/out.txt

@@ -1,102 +0,0 @@
-
-package user // import "imuslab.com/arozos/mod/user"
-
-
-TYPES
-
-type User struct {
-	Username        string
-	StorageQuota    *quota.QuotaHandler
-	PermissionGroup []*permission.PermissionGroup
-	HomeDirectories *storage.StoragePool
-
-	// Has unexported fields.
-}
-
-func (u *User) CanRead(vpath string) bool
-    Helper function for checking permission
-
-func (u *User) CanWrite(vpath string) bool
-
-func (u *User) GetAllFileSystemHandler() []*fs.FileSystemHandler
-
-func (u *User) GetFileOwner(realpath string) string
-
-func (u *User) GetFileSystemHandlerFromRealPath(rpath string) (*fs.FileSystemHandler, error)
-
-func (u *User) GetFileSystemHandlerFromVirtualPath(vpath string) (*fs.FileSystemHandler, error)
-    Get a file system handler from a virtual path, this file system handler
-    might not be the highest prioity one
-
-func (u *User) GetHighestAccessRightStoragePool(fsUUID string) (*storage.StoragePool, error)
-    Get the highest access right to the given fs uuid
-
-func (u *User) GetHomeDirectory() (string, error)
-
-func (u *User) GetInterfaceModules() []string
-    Get the (or a list of ) Interface Module (aka booting module) for this user,
-    returning module uuids
-
-func (u *User) GetModuleAccessPermission(moduleName string) bool
-    Permissions related to modules
-
-func (u *User) GetPathAccessPermission(vpath string) string
-    Check if the user has access to this virthal filepath
-
-func (u *User) GetUserIcon() string
-    Get the current user icon
-
-func (u *User) GetUserPermissionGroup() []*permission.PermissionGroup
-
-func (u *User) HaveSpaceFor(realpath string) bool
-    Return the user quota information, returning used / total
-
-func (u *User) IsAdmin() bool
-
-func (u *User) IsOwnerOfFile(realpath string) bool
-
-func (u *User) Parent() *UserHandler
-
-func (u *User) RealPathToVirtualPath(rpath string) (string, error)
-
-func (u *User) RemoveOwnershipFromFile(realpath string) error
-
-func (u *User) RemoveUser()
-    Remove the current user
-
-func (u *User) SetOwnerOfFile(realpath string) error
-
-func (u *User) SetUserIcon(base64data string)
-    Set the current user icon
-
-func (u *User) SetUserPermissionGroup(groups []*permission.PermissionGroup)
-
-func (u *User) UserIsInOneOfTheGroupOf(groupnames []string) bool
-    Check if the user is in one of the permission groups, require groupname
-
-func (u *User) VirtualPathToRealPath(vpath string) (string, error)
-
-type UserHandler struct {
-	// Has unexported fields.
-}
-
-func NewUserHandler(systemdb *db.Database, authAgent *auth.AuthAgent, permissionHandler *permission.PermissionHandler, baseStoragePool *storage.StoragePool) (*UserHandler, error)
-    Initiate a new user handler
-
-func (u *UserHandler) GetAuthAgent() *auth.AuthAgent
-    Return the user handler's auth agent
-
-func (u *UserHandler) GetDatabase() *db.Database
-
-func (u *UserHandler) GetPermissionHandler() *permission.PermissionHandler
-
-func (u *UserHandler) GetStoragePool() *storage.StoragePool
-
-func (u *UserHandler) GetUserInfoFromRequest(w http.ResponseWriter, r *http.Request) (*User, error)
-    Get user obejct from session
-
-func (u *UserHandler) GetUserInfoFromUsername(username string) (*User, error)
-    Get User object from username
-
-func (u *UserHandler) UpdateStoragePool(newpool *storage.StoragePool)
-