From 794e9a3bf77ccd6c1faefdac59b91c9147f3269a Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Mon, 6 Sep 2021 10:46:12 +0000
Subject: [PATCH] Check if SVG path is valid

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
---
 core/Controller/SvgController.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/Controller/SvgController.php b/core/Controller/SvgController.php
index 573f245c5a1..1a5a547d140 100644
--- a/core/Controller/SvgController.php
+++ b/core/Controller/SvgController.php
@@ -31,6 +31,7 @@ declare(strict_types=1);
 
 namespace OC\Core\Controller;
 
+use OC\Files\Filesystem;
 use OC\Template\IconsCacher;
 use OCP\App\AppPathNotFoundException;
 use OCP\App\IAppManager;
@@ -117,6 +118,10 @@ class SvgController extends Controller {
 	 * @return DataDisplayResponse|NotFoundResponse
 	 */
 	private function getSvg(string $path, string $color, string $fileName) {
+		if(!Filesystem::isValidPath($path)) {
+			return new NotFoundResponse();
+		}
+
 		if (!file_exists($path)) {
 			return new NotFoundResponse();
 		}