fix for the CVE-2022-31836 4ca2780dbf19d137746041886525fdebe594e50a (#5707)

Co-authored-by: Ming Deng <mingflycash@gmail.com>
2024-10-31 18:14:58 +05:30 · 2024-10-31 18:14:58 +05:30 · b602bdafcd
commit b602bdafcd
parent d5830a0fc2
7 changed files with 8 additions and 0 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,4 +1,5 @@
 # developing
+- [Fix issue 4961, `leafInfo.match()` use `path.join()` to deal with `wildcardValues`, which may lead to cross directory risk ](https://github.com/beego/beego/pull/4964)

 # v2.1.2
 - [refactor: CONTRIBUTING.md file grammatical improvements](https://github.com/beego/beego/issues/5411)
--- a/server/web/session/ledis/http:/host:port/LOCK
+++ b/server/web/session/ledis/http:/host:port/LOCK
--- a/server/web/session/ledis/http:/host:port/goleveldb_data/000001.log
+++ b/server/web/session/ledis/http:/host:port/goleveldb_data/000001.log
--- a/server/web/session/ledis/http:/host:port/goleveldb_data/CURRENT
+++ b/server/web/session/ledis/http:/host:port/goleveldb_data/CURRENT
@ -0,0 +1 @@
+MANIFEST-000000
--- a/server/web/session/ledis/http:/host:port/goleveldb_data/LOCK
+++ b/server/web/session/ledis/http:/host:port/goleveldb_data/LOCK
--- a/server/web/session/ledis/http:/host:port/goleveldb_data/LOG
+++ b/server/web/session/ledis/http:/host:port/goleveldb_data/LOG
@ -0,0 +1,6 @@
+=============== Sep 23, 2024 (IST) ===============
+13:20:45.857549 log@legend F·NumFile S·FileSize N·Entry C·BadEntry B·BadBlock Ke·KeyError D·DroppedEntry L·Level Q·SeqNum T·TimeElapsed
+13:20:45.857715 db@open opening
+13:20:46.025077 version@stat F·[] S·0B[] Sc·[]
+13:20:46.127801 db@janitor F·2 G·0
+13:20:46.127844 db@open done T·270.109817ms
--- a/server/web/session/ledis/http:/host:port/goleveldb_data/MANIFEST-000000
+++ b/server/web/session/ledis/http:/host:port/goleveldb_data/MANIFEST-000000