diff --git a/LaunchServer/src/main/java/pro/gravit/launchserver/websocket/fileserver/FileServerHandler.java b/LaunchServer/src/main/java/pro/gravit/launchserver/websocket/fileserver/FileServerHandler.java index 3a3af245..290b745d 100644 --- a/LaunchServer/src/main/java/pro/gravit/launchserver/websocket/fileserver/FileServerHandler.java +++ b/LaunchServer/src/main/java/pro/gravit/launchserver/websocket/fileserver/FileServerHandler.java @@ -17,6 +17,7 @@ import java.io.UnsupportedEncodingException; import java.net.URLDecoder; import java.nio.file.Path; +import java.nio.file.Paths; import java.text.SimpleDateFormat; import java.util.Calendar; import java.util.Date; @@ -189,15 +190,7 @@ private static String sanitizeUri(String uri) { // Convert file separators. uri = uri.replace(File.separatorChar, '/'); - // Simplistic dumb security check. - // You will have to do something serious in the production environment. - if (uri.contains(File.separator + '.') || - uri.contains('.' + File.separator) || - uri.charAt(0) == '.' || uri.charAt(uri.length() - 1) == '.' || - INSECURE_URI.matcher(uri).matches()) { - return null; - } - return uri.substring(1); + return Paths.get(uri).normalize().toString().substring(1); } private static final Pattern ALLOWED_FILE_NAME = Pattern.compile("[^-\\._]?[^<>&\\\"]*");