search

silverstripe / silverstripe-framework

Silverstripe Framework, the MVC framework that powers Silverstripe CMS
https://www.silverstripe.org
BSD 3-Clause "New" or "Revised" License
720 stars 820 forks source link

Files with dots in the name break #11216

Closed Firesphere closed 1 month ago

Firesphere commented 2 months ago

Module version(s) affected

5.2.x

Description

A bit more background is here: https://github.com/heyday/silverstripe-responsive-images/issues/39

A file containing dots, e.g. myexample...testfile.png breaks in version 5.2 with the following error:

[Emergency] Uncaught InvalidArgumentException: Can not collapse relative folders
GET /?flush=all

Line 38 in /var/www/html/vendor/silverstripe/framework/src/Core/Path.php
Click to see stack trace ```text Source 29 $parts = $parts[0]; 30 } 31 32 // Cleanup and join all parts 33 $parts = array_filter(array_map('trim', array_filter($parts ?? []))); 34 $fullPath = static::normalise(implode(DIRECTORY_SEPARATOR, $parts)); 35 36 // Protect against directory traversal vulnerability (OTG-AUTHZ-001) 37 if (strpos($fullPath ?? '', '..') !== false) { 38 throw new InvalidArgumentException('Can not collapse relative folders'); 39 } 40 41 return $fullPath ?: DIRECTORY_SEPARATOR; 42 } 43 44 /** Trace SilverStripe\Core\Path::join(Uploads/Elements/Features, Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc) AbstractFileIDHelper.php:100 SilverStripe\Assets\FilenameParsing\AbstractFileIDHelper->swapExtension(Uploads/Elements/Features/Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc.png, FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, 1) AbstractFileIDHelper.php:44 SilverStripe\Assets\FilenameParsing\AbstractFileIDHelper->buildFileID(Uploads/Elements/Features/Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc.png, eabb96aa34846c8e84c9147dbd23818ad2d72e5f, FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ) FileIDHelperResolutionStrategy.php:394 SilverStripe\Assets\FilenameParsing\FileIDHelperResolutionStrategy->buildFileID(SilverStripe\Assets\FilenameParsing\ParsedFileID) FlysystemAssetStore.php:275 SilverStripe\Assets\Flysystem\FlysystemAssetStore->applyToFileOnFilesystem(Closure, SilverStripe\Assets\FilenameParsing\ParsedFileID) FlysystemAssetStore.php:1117 SilverStripe\Assets\Flysystem\FlysystemAssetStore->exists(Uploads/Elements/Features/Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc.png, eabb96aa34846c8e84c9147dbd23818ad2d72e5f, FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ) ImageManipulation.php:956 SilverStripe\Assets\File->manipulate(FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, Closure) ImageManipulation.php:866 SilverStripe\Assets\File->manipulateImage(FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, Closure) FocusPointExtension.php:152 JonoM\FocusPoint\Extensions\FocusPointExtension->manipulateImageCropData(FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, Array) FocusPointExtension.php:109 JonoM\FocusPoint\Extensions\FocusPointExtension->FocusFill(1920, 1080) call_user_func_array(Array, Array) Extensible.php:135 SilverStripe\View\ViewableData->SilverStripe\Core\{closure}(SilverStripe\Assets\Image, Array) CustomMethods.php:64 SilverStripe\View\ViewableData->__call(FocusFill, Array) call_user_func_array(Array, Array) ResponsiveImageExtension.php:157 Heyday\ResponsiveImages\ResponsiveImageExtension->getResampledImage(FocusFill, Array) ResponsiveImageExtension.php:128 Heyday\ResponsiveImages\ResponsiveImageExtension->createResponsiveSet(Array, Array, responsiveset1) ResponsiveImageExtension.php:75 Heyday\ResponsiveImages\ResponsiveImageExtension->__call(responsiveset1, Array) call_user_func_array(Array, Array) Extensible.php:135 SilverStripe\View\ViewableData->SilverStripe\Core\{closure}(SilverStripe\Assets\Image, Array) CustomMethods.php:64 SilverStripe\View\ViewableData->__call(ResponsiveSet1, Array) ```

This issue does not happen in 5.1.x.

How to reproduce

  1. Standard set-up with Framework 5.1, even bare-bones works
  2. Try to upload a file with dots in the name. This works
  3. Have this file show in the frontend. This works
  4. Update to Framework 5.2
  5. The site now breaks with the aforementioned error

Possible Solution

No response

Additional Context

No response

Validations

See also

PRs

emteknetnz commented 1 month ago

Linked PR has been merged, it will be automatically tagged shortly