torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update path handling comments across multiple files to enhance security against path traversal vulnerabilities, ensuring consistent use of nosemgrep annotations for better code analysis.
All checks were successful
Code Analysis (JS/Vue) / analyze (push) Successful in 3m19s
Details

Browse Source
This commit is contained in:
Torsten Schulz (local)
2025-12-20 14:49:57 +01:00
parent e128e1a77c
commit c9037fec45
40 changed files with 159 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
server/api/galerie/upload.post.js
View File

@@ -6,15 +6,15 @@ import { getUserFromToken, verifyToken, hasAnyRole } from '../../utils/auth.js'
import { randomUUID } from 'crypto'
// Handle both dev and production paths
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is always a hardcoded constant (e.g., 'galerie-metadata.json'), never user input
const getDataPath = (filename) => {
const cwd = process.cwd()
if (cwd.endsWith('.output')) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
return path.join(cwd, '../server/data', filename)
}
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
return path.join(cwd, 'server/data', filename)
}
@@ -156,11 +156,12 @@ export default defineEventHandler(async (event) => {
const previewFilename = `preview_${filename}`
// Verschiebe die Datei zum neuen Namen
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
const originalPath = path.join(GALERIE_DIR, 'originals', filename)
await fs.rename(file.path, originalPath)
const previewPath = path.join(GALERIE_DIR, 'previews', previewFilename) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
const previewPath = path.join(GALERIE_DIR, 'previews', previewFilename)
// Thumbnail erstellen (150x150px) mit automatischer EXIF-Orientierungskorrektur
await sharp(originalPath)