From bedbc8162d9f30d330bc9ba3b8631211e2f74f64 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 15 Mar 2024 15:16:01 +0900 Subject: [PATCH 1/2] Bump google.golang.org/protobuf from 1.30.0 to 1.33.0 (#608) Bumps google.golang.org/protobuf from 1.30.0 to 1.33.0. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 95ee1bf..3dd7387 100644 --- a/go.mod +++ b/go.mod @@ -90,7 +90,7 @@ require ( google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect google.golang.org/grpc v1.56.3 // indirect - google.golang.org/protobuf v1.30.0 // indirect + google.golang.org/protobuf v1.33.0 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect storj.io/drpc v0.0.33-0.20230204035225-c9649dee8f2a // indirect storj.io/picobuf v0.0.1 // indirect diff --git a/go.sum b/go.sum index 690cdea..bfcacf8 100644 --- a/go.sum +++ b/go.sum @@ -362,8 +362,8 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng= -google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI= +google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From 1eecc22fb3f3ce56295044fc7eba4e5aadff694f Mon Sep 17 00:00:00 2001 From: Alexey Kostin Date: Wed, 20 Mar 2024 03:02:57 +0300 Subject: [PATCH 2/2] Normalize upload file name (#606) * Generate secure token using crypto rand * Normalize names of uploaded files * revert token.go accidentally added to commit * better input filename normalization using transfrom chain * remove unused line --------- Co-authored-by: Alexey Kostin Co-authored-by: Andrea Spacca --- go.mod | 3 ++- go.sum | 2 ++ server/handlers.go | 23 ++++++++++++++++++++++- 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 3dd7387..abbeb91 100644 --- a/go.mod +++ b/go.mod @@ -16,6 +16,7 @@ require ( github.com/dutchcoders/go-virustotal v0.0.0-20140923143438-24cc8e6fa329 github.com/dutchcoders/transfer.sh-web v0.0.0-20221119114740-ca3a2621d2a6 github.com/elazarl/go-bindata-assetfs v1.0.1 + github.com/emicklei/go-restful v2.16.0+incompatible github.com/fatih/color v1.14.1 github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f github.com/gorilla/handlers v1.5.1 @@ -29,6 +30,7 @@ require ( golang.org/x/crypto v0.17.0 golang.org/x/net v0.17.0 golang.org/x/oauth2 v0.7.0 + golang.org/x/text v0.14.0 google.golang.org/api v0.114.0 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c storj.io/common v0.0.0-20230301105927-7f966760c100 @@ -86,7 +88,6 @@ require ( go.opencensus.io v0.24.0 // indirect golang.org/x/sync v0.1.0 // indirect golang.org/x/sys v0.15.0 // indirect - golang.org/x/text v0.14.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect google.golang.org/grpc v1.56.3 // indirect diff --git a/go.sum b/go.sum index bfcacf8..401fe98 100644 --- a/go.sum +++ b/go.sum @@ -85,6 +85,8 @@ github.com/dutchcoders/transfer.sh-web v0.0.0-20221119114740-ca3a2621d2a6 h1:7uT github.com/dutchcoders/transfer.sh-web v0.0.0-20221119114740-ca3a2621d2a6/go.mod h1:F6Q37CxDh2MHr5KXkcZmNB3tdkK7v+bgE+OpBY+9ilI= github.com/elazarl/go-bindata-assetfs v1.0.1 h1:m0kkaHRKEu7tUIUFVwhGGGYClXvyl4RE03qmvRTNfbw= github.com/elazarl/go-bindata-assetfs v1.0.1/go.mod h1:v+YaWX3bdea5J/mo8dSETolEo7R71Vk1u8bnjau5yw4= +github.com/emicklei/go-restful v2.16.0+incompatible h1:rgqiKNjTnFQA6kkhFe16D8epTksy9HQ1MyrbDXSdYhM= +github.com/emicklei/go-restful v2.16.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= diff --git a/server/handlers.go b/server/handlers.go index 265aab4..4f1b16a 100644 --- a/server/handlers.go +++ b/server/handlers.go @@ -51,6 +51,7 @@ import ( "sync" textTemplate "text/template" "time" + "unicode" "github.com/ProtonMail/go-crypto/openpgp" "github.com/ProtonMail/go-crypto/openpgp/armor" @@ -66,6 +67,9 @@ import ( blackfriday "github.com/russross/blackfriday/v2" qrcode "github.com/skip2/go-qrcode" "golang.org/x/net/idna" + "golang.org/x/text/runes" + "golang.org/x/text/transform" + "golang.org/x/text/unicode/norm" ) const getPathPart = "get" @@ -418,7 +422,24 @@ func (s *Server) notFoundHandler(w http.ResponseWriter, _ *http.Request) { } func sanitize(fileName string) string { - return path.Base(fileName) + t := transform.Chain( + norm.NFD, + runes.Remove(runes.In(unicode.Cc)), + runes.Remove(runes.In(unicode.Cf)), + runes.Remove(runes.In(unicode.Co)), + runes.Remove(runes.In(unicode.Cs)), + runes.Remove(runes.In(unicode.Other)), + runes.Remove(runes.In(unicode.Zl)), + runes.Remove(runes.In(unicode.Zp)), + norm.NFC) + newName, _, err := transform.String(t, fileName) + if err != nil { + return path.Base(fileName) + } + if len(newName) == 0 { + newName = "_" + } + return path.Base(newName) } func (s *Server) postHandler(w http.ResponseWriter, r *http.Request) {