search

yfszzx / stable-diffusion-webui-images-browser

an images browse for stable-diffusion-webui
489 stars 232 forks source link

Path Traversal Exploit #3

Closed LilyRose2798 closed 2 years ago

LilyRose2798 commented 2 years ago

The "custom folder" tab lets you enter any directory anywhere on the system, including network shares, not just subdirectories of the webui. For example: ..\..\\<path> - access directories multiple levels above the webui C:\\<path> - access directories under any drive letter mounted on the system running the webui \\\<network path> - access directories on any networked device connected to the system running the webui

The path should be limited to only subdirectories of the webui. Some of the solutions listed here should work, such as Path(webui_dir).joinpath(user_specified_dir).resolve().relative_to(webui_dir.resolve())

yfszzx commented 2 years ago

Thanks, I will improve

MrAcademy commented 2 years ago

Apologies for my comment - I've opened another issue report for it since it's not directly related, but please note when fixing this that some people use image directories that are outside the webui source code directory. Perhaps it should be configurable whether or not to enforce this.

yfszzx commented 2 years ago

fixed

yfszzx commented 2 years ago

Apologies for my comment - I've opened another issue report for it since it's not directly related, but please note when fixing this that some people use image directories that are outside the webui source code directory. Perhaps it should be configurable whether or not to enforce this.

add command line argument option '--administrator' to visit all directory, but this needs to wait until webui merge my new PR