obsidian-plugin/fancive_obsidian-parallel-reader
1
0
Fork 0
mirror of https://github.com/fancive/obsidian-parallel-reader.git synced 2026-07-22 06:53:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: strip path traversal segments from vault paths

Browse source 
Reject '..' and '.' segments in normalizeVaultPath to prevent
exportFolder from escaping the vault root directory.

Change-Id: Ib4da19f9d0aa1236a3b77b6f2cc722fcff408131
This commit is contained in:
wujunchen 2026-04-26 09:48:19 +08:00
parent d37e6c5e72
commit b7d1a25543
3 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
main.js
View file

File diff suppressed because one or more lines are too long

2
src/vault.ts
View file

@ -6,7 +6,7 @@ export function normalizeVaultPath(path: string): string {
return String(path || '')
.split('/')
.map((part) => part.trim())
.filter(Boolean)
.filter((part) => !!part && part !== '..' && part !== '.')
.join('/');
}

3
tests/modules.test.js
View file

@ -173,6 +173,9 @@ assert.deepStrictEqual(t.folderPathsForTarget(''), [], 'empty path');
assert.deepStrictEqual(t.folderPathsForTarget('A/B/C'), ['A', 'A/B', 'A/B/C']);
assert.deepStrictEqual(t.folderPathsForTarget('/A//B/'), ['A', 'A/B'], 'normalizes slashes');
assert.deepStrictEqual(t.folderPathsForTarget('single'), ['single']);
assert.deepStrictEqual(t.folderPathsForTarget('../../etc/passwd'), ['etc', 'etc/passwd'], 'strips .. path traversal');
assert.deepStrictEqual(t.folderPathsForTarget('./a/../b'), ['a', 'a/b'], 'strips . and .. segments');
assert.deepStrictEqual(t.folderPathsForTarget('a/../../b'), ['a', 'a/b'], 'strips mid-path ..');
// ── i18n.ts ──