XingfenD/book-comic-library
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(backend): single error body on pages paths, reject newline entry names, empty-index cache skip

Browse Source
This commit is contained in:
XingfenD
2026-09-05 20:56:05 +08:00
parent 0946f6be5a
commit 8206c7a4ed
3 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/bookfile/zip.go
+1 -1
View File
@@ -15,7 +15,7 @@ var ErrNotZip = errors.New("not a readable zip")
var ErrUnsafeZip = errors.New("unsafe zip entry")
func unsafeEntry(n string) bool {
return strings.HasPrefix(n, "/") || strings.Contains(n, "..") || strings.ContainsRune(n, '\\')
return strings.HasPrefix(n, "/") || strings.Contains(n, "..") || strings.ContainsRune(n, '\\') || strings.ContainsAny(n, "\n\r")
}
func isImage(name string) bool {
backend/internal/bookfile/zip_test.go
+1 -1
View File
@@ -39,7 +39,7 @@ func TestPageIndexSortAndFilter(t *testing.T) {
}
func TestPageIndexRejectsSlip(t *testing.T) {
for _, bad := range []string{"../evil.jpg", "/etc/passwd.jpg", "a\\..\\b.jpg"} {
for _, bad := range []string{"../evil.jpg", "/etc/passwd.jpg", "a\\..\\b.jpg", "pag\ne.jpg", "pag\re.jpg"} {
r := zipOf(t, bad)
if _, err := PageIndex(r, int64(r.Len())); err == nil {
t.Fatalf("entry %q must be rejected", bad)