fix for the CVE-2022-31836 4ca2780 (#5707)

Co-authored-by: Ming Deng <mingflycash@gmail.com>
beego · Oct 31, 2024 · b602bda · b602bda
1 parent d5830a0
commit b602bda
Show file tree

Hide file tree

Showing 7 changed files with 8 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,4 +1,5 @@
 # developing
+- [Fix issue 4961, `leafInfo.match()` use `path.join()` to deal with `wildcardValues`, which may lead to cross directory risk ](https://github.com/beego/beego/pull/4964)
 
 # v2.1.2
 - [refactor: CONTRIBUTING.md file grammatical improvements](https://github.com/beego/beego/issues/5411)

diff --git a/server/web/session/ledis/http:/host:port/LOCK b/server/web/session/ledis/http:/host:port/LOCK
diff --git a/server/web/session/ledis/http:/host:port/goleveldb_data/000001.log b/server/web/session/ledis/http:/host:port/goleveldb_data/000001.log
diff --git a/server/web/session/ledis/http:/host:port/goleveldb_data/CURRENT b/server/web/session/ledis/http:/host:port/goleveldb_data/CURRENT
@@ -0,0 +1 @@
+MANIFEST-000000
diff --git a/server/web/session/ledis/http:/host:port/goleveldb_data/LOCK b/server/web/session/ledis/http:/host:port/goleveldb_data/LOCK
diff --git a/server/web/session/ledis/http:/host:port/goleveldb_data/LOG b/server/web/session/ledis/http:/host:port/goleveldb_data/LOG
@@ -0,0 +1,6 @@
+=============== Sep 23, 2024 (IST) ===============
+13:20:45.857549 log@legend F·NumFile S·FileSize N·Entry C·BadEntry B·BadBlock Ke·KeyError D·DroppedEntry L·Level Q·SeqNum T·TimeElapsed
+13:20:45.857715 db@open opening
+13:20:46.025077 version@stat F·[] S·0B[] Sc·[]
+13:20:46.127801 db@janitor F·2 G·0
+13:20:46.127844 db@open done T·270.109817ms
diff --git a/server/web/session/ledis/http:/host:port/goleveldb_data/MANIFEST-000000 b/server/web/session/ledis/http:/host:port/goleveldb_data/MANIFEST-000000