Doni/safesight
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: read filename from Content-Disposition header bypassing Go sanitization

Browse Source
This commit is contained in:
tian 2026-05-08 10:17:50 +08:00
parent ca6edafbce
commit bfb8334379
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
internal/web/ui.go
View File

@ -4032,8 +4032,16 @@ func (u *UI) actionFaceGalleryImport(w http.ResponseWriter, r *http.Request) {
count := 0 count := 0
for _, files := range r.MultipartForm.File { for _, files := range r.MultipartForm.File {
for _, hdr := range files { for _, hdr := range files {
// webkitdirectory paths can have varying depth, extract last dir as person name // Go 1.20+ sanitizes hdr.Filename to basename only, parse raw Content-Disposition for full path
parts := strings.Split(strings.ReplaceAll(hdr.Filename, "\\", "/"), "/") cd := hdr.Header.Get("Content-Disposition")
fullPath := hdr.Filename
if idx := strings.LastIndex(cd, `filename="`); idx >= 0 {
start := idx + len(`filename="`)
if end := strings.IndexByte(cd[start:], '"'); end >= 0 {
fullPath = cd[start : start+end]
}
}
parts := strings.Split(strings.ReplaceAll(fullPath, "\\", "/"), "/")
if len(parts) < 2 { if len(parts) < 2 {
continue continue
} }