search

flofriday / thumbcloud

Thumbcloud is a file-sharing server to replace your USB thumbdrive.
MIT License
103 stars 9 forks source link

Relative paths not working #4

Open bernardobelchior opened 6 years ago

bernardobelchior commented 6 years ago

Hi, it's me again :smile: I was trying to run thumbcloud, but it seems it doesn't really work with relatives paths. The commands below error out, printing SECURITY: prevented path traversal attack:

But absolute paths work fine:

May be worth adding some tests regarding this.

flofriday commented 6 years ago

Thank you for testing :smile:.

Ok I understand why that is happening and I it should be an easy fix.

flofriday commented 6 years ago

I never gave it a try because variables like $HOME worked just fine. The difference is a variable like that gets converted to an absolute path by the shell. However, relative paths just get passed to the program like a string.

flofriday commented 6 years ago

Thumbcloud now also prints the path it is sharing, this is a nice feature to double check if the path is correct.

Since you now tested the program, do you think it is easy enough to use? Are there any things you struggled with? (Not really bugs but just the ergonomics of using it.)

Thank you again for testing my program 😄

bernardobelchior commented 6 years ago

I've only given it a small look, but it seems ok 😊

I also found a small problem with Firefox (not sure if it works on other browsers): when trying to download a file with a dot (.), like .env it doesn't work.

flofriday commented 6 years ago

Thank you again for the bug ... I know there are some bugs with strange file names. Unfortunately I didn't wrote the code for downloading files, it already was a piece of the library I am using. However, if I don't find a workaround I have to rewrite it.

So the bug is not browser specific.