From 7faea4067492d10b1ab43402d0bd8d76dd8bab05 Mon Sep 17 00:00:00 2001 From: idafurjes <36131195+idafurjes@users.noreply.github.com> Date: Thu, 26 Aug 2021 09:07:27 +0200 Subject: [PATCH] API: Add short url validation (#38436) * Add short url validation Path should not contain string ../ * Update pkg/api/short_url.go Co-authored-by: Marcus Efraimsson Co-authored-by: Marcus Efraimsson --- pkg/api/short_url.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/api/short_url.go b/pkg/api/short_url.go index b894a649fe7..ab131e9fd6f 100644 --- a/pkg/api/short_url.go +++ b/pkg/api/short_url.go @@ -23,6 +23,10 @@ func (hs *HTTPServer) createShortURL(c *models.ReqContext, cmd dtos.CreateShortU hs.log.Error("Invalid short URL path", "path", cmd.Path) return response.Error(400, "Path should be relative", nil) } + if strings.Contains(cmd.Path, "../") { + hs.log.Error("Invalid short URL path", "path", cmd.Path) + return response.Error(400, "Invalid path", nil) + } shortURL, err := hs.ShortURLService.CreateShortURL(c.Req.Context(), c.SignedInUser, cmd.Path) if err != nil {