apluslms / gitmanager

Git manager service for A+. Separated from the MOOC-Grader.
0 stars 6 forks source link

unprotected_paths may point to files outside the static directory #14

Closed lainets closed 2 years ago

lainets commented 2 years ago

The unprotected_files list may have entries starting with "../", in which case a symlink is created to a file outside the course's static directory. On top of that, the symlink itself will be created outside the nginx's static directory, and will thus never be removed.

Validation needs to be added to the unprotected_files to ban targets that point outside the static directory.