search

RealJammy / The-Jambot

A repo for my discord bot!
4 stars 13 forks source link

Fix Directory Traversal #71

Closed Day91 closed 3 years ago

Day91 commented 3 years ago

In the maths cog, a few of the commands designed to grab files for JMC/IMC/SMC questions were vulnerable to directory traversal, as demonstrated below. This could be used to retrieve credentials and bot tokens. This should fix these issues by requiring integer years, so "../" and the like cannot be used.

Screenshot 2020-10-03 at 10 27 41
JamBot3000 commented 3 years ago

Epic yes, this would work. We are also probably at some point going to use the links to the images, instead of the images themselves as they will send quicker that way. Merged :)