cleaning file path (#206)

to prevent path traversal outside the box
gobuffalo · Jun 5, 2019 · f58136c · f58136c
1 parent 53c9ca9
commit f58136c
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/v2/box.go b/v2/box.go
@@ -12,12 +12,13 @@ import (
 	"sort"
 	"strings"
 
+	"errors"
+
 	"github.com/gobuffalo/packd"
 	"github.com/gobuffalo/packr/v2/file"
 	"github.com/gobuffalo/packr/v2/file/resolver"
 	"github.com/gobuffalo/packr/v2/plog"
 	"github.com/markbates/oncer"
-	"errors"
 )
 
 var _ packd.Box = &Box{}
@@ -216,7 +217,7 @@ func (b *Box) Resolve(key string) (file.File, error) {
 
 	f, err := r.Resolve(b.Name, key)
 	if err != nil {
-		z := filepath.Join(resolver.OsPath(b.ResolutionDir), resolver.OsPath(key))
+		z := filepath.Join(resolver.OsPath(b.ResolutionDir), filepath.FromSlash(path.Clean("/"+resolver.OsPath(key))))
 		f, err = r.Resolve(b.Name, z)
 		if err != nil {
 			plog.Debug(r, "Resolve", "box", b.Name, "key", z, "err", err)