Skip to content

Commit

Permalink
added file stat and path check
Browse files Browse the repository at this point in the history
  • Loading branch information
MrStashley committed Mar 18, 2024
1 parent 57f6c33 commit ca0240c
Show file tree
Hide file tree
Showing 4 changed files with 76 additions and 20 deletions.
17 changes: 0 additions & 17 deletions src/models/model.ts
Original file line number Diff line number Diff line change
Expand Up @@ -216,23 +216,6 @@ class Model {
return resp.json();
}).then((userKeybindings) => {
this.keybindManager.setUserKeybindings(userKeybindings);
this.testConfigListDir();
});
}

testConfigListDir() {
const url = new URL(this.getBaseHostPort() + "/config/");
let prtn = fetch(url, { method: "get", body: null, headers: this.getFetchHeaders() });
prtn.then((resp) => {
if (resp.status == 404) {
return [];
} else if (!resp.ok) {
console.log("resp not ok", resp);
util.handleNotOkResp(resp, url);
}
return resp.json();
}).then((configDirList) => {
console.log("got json: ", configDirList);
});
}

Expand Down
4 changes: 4 additions & 0 deletions src/types/custom.d.ts
Original file line number Diff line number Diff line change
Expand Up @@ -797,12 +797,16 @@ declare global {
};

type FileInfoType = {
type: string;
name: string;
size: number;
modts: number;
isdir: boolean;
perm: number;
notfound: boolean;
modestr?: string;
path?: string;
outputpos?: number;
};

type ExtBlob = Blob & {
Expand Down
49 changes: 49 additions & 0 deletions waveshell/pkg/packet/packet.go
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,11 @@ import (
"errors"
"fmt"
"io"
"io/fs"
"os"
"reflect"
"sync"
"time"

"github.com/wavetermdev/waveterm/waveshell/pkg/base"
"github.com/wavetermdev/waveterm/waveshell/pkg/wlog"
Expand Down Expand Up @@ -58,6 +60,7 @@ const (
WriteFileReadyPacketStr = "writefileready" // rpc-response
WriteFileDonePacketStr = "writefiledone" // rpc-response
FileDataPacketStr = "filedata"
FileStatPacketStr = "filestat"
LogPacketStr = "log" // logging packet (sent from waveshell back to server)
ShellStatePacketStr = "shellstate"

Expand Down Expand Up @@ -112,6 +115,7 @@ func init() {
TypeStrToFactory[WriteFileDonePacketStr] = reflect.TypeOf(WriteFileDonePacketType{})
TypeStrToFactory[LogPacketStr] = reflect.TypeOf(LogPacketType{})
TypeStrToFactory[ShellStatePacketStr] = reflect.TypeOf(ShellStatePacketType{})
TypeStrToFactory[FileStatPacketStr] = reflect.TypeOf(FileStatPacketType{})

var _ RpcPacketType = (*RunPacketType)(nil)
var _ RpcPacketType = (*GetCmdPacketType)(nil)
Expand Down Expand Up @@ -379,6 +383,51 @@ func MakeReInitPacket() *ReInitPacketType {
return &ReInitPacketType{Type: ReInitPacketStr}
}

type FileStatPacketType struct {
Type string `json:"type"`
Name string `json:"name"`
Size int64 `json:"size"`
ModTs time.Time `json:"modts"`
IsDir bool `json:"isdir"`
Perm int `json:"perm"`
ModeStr string `json:"modestr"`
Error string `json:"error"`
Done bool `json:"done"`
RespId string `json:"respid"`
Path string `json:"path"`
}

func (*FileStatPacketType) GetType() string {
return FileStatPacketStr
}

func (p *FileStatPacketType) GetResponseDone() bool {
return p.Done
}

func (p *FileStatPacketType) GetResponseId() string {
return p.RespId
}

func MakeFileStatPacketType() *FileStatPacketType {
return &FileStatPacketType{Type: FileStatPacketStr}
}

func MakeFileStatPacketFromFileInfo(finfo fs.FileInfo, err string, done bool) *FileStatPacketType {
resp := MakeFileStatPacketType()
resp.Error = err
resp.Done = done

resp.IsDir = finfo.IsDir()
resp.Name = finfo.Name()

resp.Size = finfo.Size()
resp.ModTs = finfo.ModTime()
resp.Perm = int(finfo.Mode().Perm())
resp.ModeStr = finfo.Mode().String()
return resp
}

type StreamFilePacketType struct {
Type string `json:"type"`
ReqId string `json:"reqid"`
Expand Down
26 changes: 23 additions & 3 deletions wavesrv/cmd/main-server.go
Original file line number Diff line number Diff line change
Expand Up @@ -680,7 +680,20 @@ func HandleRunCommand(w http.ResponseWriter, r *http.Request) {
func CheckIsDir(dirHandler http.Handler, fileHandler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
configPath := r.URL.Path
configFullPath := path.Join(scbase.GetWaveHomeDir(), configPath)
configAbsPath, err := filepath.Abs(configPath)
if err != nil {
w.WriteHeader(500)
w.Write([]byte(fmt.Sprintf("error getting absolute path", err)))
return
}
configBaseDir := path.Join(scbase.GetWaveHomeDir(), "config")
configFullPath := path.Join(scbase.GetWaveHomeDir(), configAbsPath)
log.Printf("base dir: %v full path: %v", configBaseDir, configFullPath)
if !strings.HasPrefix(configFullPath, configBaseDir) {
w.WriteHeader(500)
w.Write([]byte(fmt.Sprintf("error: path is not in config folder")))
return
}
fstat, err := os.Stat(configFullPath)
if err != nil {
w.WriteHeader(500)
Expand Down Expand Up @@ -876,6 +889,7 @@ func doShutdown(reason string) {
}

func configDirHandler(w http.ResponseWriter, r *http.Request) {
log.Printf("running?")
configPath := r.URL.Path
configFullPath := path.Join(scbase.GetWaveHomeDir(), configPath)
dirFile, err := os.Open(configFullPath)

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
Expand All @@ -884,13 +898,19 @@ func configDirHandler(w http.ResponseWriter, r *http.Request) {
w.Write([]byte(fmt.Sprintf("error opening specified dir: ", err)))
return
}
entries, err := dirFile.Readdirnames(0)
entries, err := dirFile.Readdir(0)
if err != nil {
w.WriteHeader(500)
w.Write([]byte(fmt.Sprintf("error getting files: ", err)))
return
}
dirListJson, err := json.Marshal(entries)
var files []*packet.FileStatPacketType
for index := 0; index < len(entries); index++ {
curEntry := entries[index]
curFile := packet.MakeFileStatPacketFromFileInfo(curEntry, "", false)
files = append(files, curFile)
}
dirListJson, err := json.Marshal(files)
if err != nil {
w.WriteHeader(500)
w.Write([]byte(fmt.Sprintf("json err: ", err)))
Expand Down

0 comments on commit ca0240c

Please sign in to comment.