Harden remaining path-construction sinks against traversal

2026-07-17 16:51:19 +02:00
parent 1a45fc82b5
commit 21801e8ba1
5 changed files with 17 additions and 10 deletions
@@ -125,7 +125,13 @@ public class ImageController : BaseJellyfinApiController
        {
            // Handle image/png; charset=utf-8
            var mimeType = Request.ContentType?.Split(';').FirstOrDefault();
-            var userDataPath = Path.Combine(_serverConfigurationManager.ApplicationPaths.UserConfigurationDirectoryPath, user.Username);
+            var userConfigurationDirectoryPath = _serverConfigurationManager.ApplicationPaths.UserConfigurationDirectoryPath;
+            var userDataPath = Path.Combine(userConfigurationDirectoryPath, user.Username);
+            if (!PathHelper.IsContainedIn(userConfigurationDirectoryPath, userDataPath))
+            {
+                return BadRequest("Invalid user.");
+            }
+
            if (user.ProfileImage is not null)
            {
                await _userManager.ClearProfileImageAsync(user).ConfigureAwait(false);