upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-15 22:11:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 27

Add missing taint analysis docblock comments, and improve escaping in some methods

Browse source 
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Carl Schwan 2022-08-31 21:15:02 +02:00 committed by Côme Chilliet
parent 4953296b9e
commit b1ec7ff51f
No known key found for this signature in database
GPG key ID: A3E2F658B28C760A
3 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apps/dashboard/lib/Controller/LayoutApiController.php
View file

@ -31,7 +31,6 @@ use OCP\IConfig;
use OCP\IRequest;
class LayoutApiController extends OCSController {
/** @var IConfig */
private $config;
/** @var string */
@ -56,6 +55,7 @@ class LayoutApiController extends OCSController {
* @return JSONResponse
*/
public function create(string $layout): JSONResponse {
$layout = htmlspecialchars($layout);
$this->config->setUserValue($this->userId, 'dashboard', 'layout', $layout);
return new JSONResponse(['layout' => $layout]);
}

1
lib/private/Files/Filesystem.php
View file

@ -642,6 +642,7 @@ class Filesystem {
* @param bool $stripTrailingSlash whether to strip the trailing slash
* @param bool $isAbsolutePath whether the given path is absolute
* @param bool $keepUnicode true to disable unicode normalization
* @psalm-taint-escape file
* @return string
*/
public static function normalizePath($path, $stripTrailingSlash = true, $isAbsolutePath = false, $keepUnicode = false) {

4
lib/private/legacy/OC_App.php
View file

@ -85,12 +85,14 @@ class OC_App {
*
* @psalm-taint-escape file
* @psalm-taint-escape include
* @psalm-taint-escape html
* @psalm-taint-escape has_quotes
*
* @param string $app AppId that needs to be cleaned
* @return string
*/
public static function cleanAppId(string $app): string {
return str_replace(['\0', '/', '\\', '..'], '', $app);
return str_replace(['<', '>', '"', "'", '\0', '/', '\\', '..'], '', $app);
}
/**