3 ms·
Their validation for Node isn't quite correct. They suggest: var filePath = path.join(targetFolder, entry.path); if (filePath.indexOf(targetFolder) != 0) {
by tlb 8y ago
Their validation for Node isn't quite correct. They suggest:
var filePath = path.join(targetFolder, entry.path);
if (filePath.indexOf(targetFolder) != 0) {
return;
}
But if targetFolder="/var/foo", then you can deposit files in "/var/foo.secret" by providing a path "../foo.secret/blub"