MCorange/wings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

router(download): validate that backup_uuid is actually a uuid

Browse Source
This commit is contained in:
Matthew Penner 2024-04-10 15:22:39 -06:00
parent c152e36101
commit 617fbcbf27
No known key found for this signature in database
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
router/router_download.go
View File

@ -8,6 +8,7 @@ import (
"strconv" "strconv"
"github.com/gin-gonic/gin" "github.com/gin-gonic/gin"
"github.com/google/uuid"
"github.com/pterodactyl/wings/router/middleware" "github.com/pterodactyl/wings/router/middleware"
"github.com/pterodactyl/wings/router/tokens" "github.com/pterodactyl/wings/router/tokens"
@ -19,12 +20,14 @@ func getDownloadBackup(c *gin.Context) {
client := middleware.ExtractApiClient(c) client := middleware.ExtractApiClient(c)
manager := middleware.ExtractManager(c) manager := middleware.ExtractManager(c)
// Get the payload from the token.
token := tokens.BackupPayload{} token := tokens.BackupPayload{}
if err := tokens.ParseToken([]byte(c.Query("token")), &token); err != nil { if err := tokens.ParseToken([]byte(c.Query("token")), &token); err != nil {
middleware.CaptureAndAbort(c, err) middleware.CaptureAndAbort(c, err)
return return
} }
// Get the server using the UUID from the token.
if _, ok := manager.Get(token.ServerUuid); !ok || !token.IsUniqueRequest() { if _, ok := manager.Get(token.ServerUuid); !ok || !token.IsUniqueRequest() {
c.AbortWithStatusJSON(http.StatusNotFound, gin.H{ c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
"error": "The requested resource was not found on this server.", "error": "The requested resource was not found on this server.",
@ -32,6 +35,14 @@ func getDownloadBackup(c *gin.Context) {
return return
} }
// Validate that the BackupUuid field is actually a UUID and not some random characters or a
// file path.
if _, err := uuid.Parse(token.BackupUuid); err != nil {
middleware.CaptureAndAbort(c, err)
return
}
// Locate the backup on the local disk.
b, st, err := backup.LocateLocal(client, token.BackupUuid) b, st, err := backup.LocateLocal(client, token.BackupUuid)
if err != nil { if err != nil {
if errors.Is(err, os.ErrNotExist) { if errors.Is(err, os.ErrNotExist) {