From 1b1c7f8f504a6faa3f0fd869f434d7df139cbdf5 Mon Sep 17 00:00:00 2001 From: Connor Tumbleson Date: Wed, 17 Jan 2024 06:11:22 -0500 Subject: [PATCH] fix: tighten up detectPossibleDirectoryTraversal for Windows --- brut.j.util/src/main/java/brut/util/BrutIO.java | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/brut.j.util/src/main/java/brut/util/BrutIO.java b/brut.j.util/src/main/java/brut/util/BrutIO.java index feecc129..e56867dc 100644 --- a/brut.j.util/src/main/java/brut/util/BrutIO.java +++ b/brut.j.util/src/main/java/brut/util/BrutIO.java @@ -95,10 +95,7 @@ public class BrutIO { } public static boolean detectPossibleDirectoryTraversal(String entry) { - if (OSDetection.isWindows()) { - return entry.contains("..\\") || entry.contains("\\.."); - } - return entry.contains("../") || entry.contains("/.."); + return entry.contains("../") || entry.contains("/..") || entry.contains("..\\") || entry.contains("\\.."); } public static String adaptSeparatorToUnix(String path) {