Skip to content

Commit c8f71af

Browse files
bergmaniabergmania
authored
Merge pull request from GHSA-j74q-mv2c-rxmp 
1 parent fa4fe47 commit c8f71af

File tree

5 files changed

+135
-1
lines changed

5 files changed

+135
-1
lines changed

‎src/Umbraco.Tests/Routing/WebPathTests.cs

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
using NUnit.Framework;
2+
using System;
3+
using Umbraco.Web.Routing;
4+
5+
namespace Umbraco.Tests.Routing
6+
{
7+
8+
[TestFixture]
9+
public class WebPathTests
10+
{
11+
12+
[Test]
13+
[TestCase("ftp://hello.com/", UriKind.Absolute, ExpectedResult = true)]
14+
[TestCase("file:///hello.com/", UriKind.Absolute, ExpectedResult = true)]
15+
[TestCase("ws://hello.com/", UriKind.Absolute, ExpectedResult = true)]
16+
[TestCase("wss://hello.com/", UriKind.Absolute, ExpectedResult = true)]
17+
[TestCase("https://hello.com:8080/", UriKind.Absolute, ExpectedResult = true)]
18+
[TestCase("http://hello.com:8080/", UriKind.Absolute, ExpectedResult = true)]
19+
[TestCase("https://hello.com/path", UriKind.Absolute, ExpectedResult = true)]
20+
[TestCase("http://hello.com/path", UriKind.Absolute, ExpectedResult = true)]
21+
[TestCase("https://hello.com/path?query=param", UriKind.Absolute, ExpectedResult = true)]
22+
[TestCase("http://hello.com/path?query=param", UriKind.Absolute, ExpectedResult = true)]
23+
[TestCase("https://hello.com/path#fragment", UriKind.Absolute, ExpectedResult = true)]
24+
[TestCase("http://hello.com/path#fragment", UriKind.Absolute, ExpectedResult = true)]
25+
[TestCase("https://hello.com/path?query=param#fragment", UriKind.Absolute, ExpectedResult = true)]
26+
[TestCase("http://hello.com/path?query=param#fragment", UriKind.Absolute, ExpectedResult = true)]
27+
[TestCase("https://hello.com:8080/path?query=param#fragment", UriKind.Absolute, ExpectedResult = true)]
28+
[TestCase("http://hello.com:8080/path?query=param#fragment", UriKind.Absolute, ExpectedResult = true)]
29+
[TestCase("//hello.com:8080/path?query=param#fragment", UriKind.Absolute, ExpectedResult = true)]
30+
[TestCase("//hello.com:8080/path", UriKind.Absolute, ExpectedResult = true)]
31+
[TestCase("//hello.com:8080", UriKind.Absolute, ExpectedResult = true)]
32+
[TestCase("//hello.com", UriKind.Absolute, ExpectedResult = true)]
33+
[TestCase("/test/test.jpg", UriKind.Absolute, ExpectedResult = false)]
34+
[TestCase("/test", UriKind.Absolute, ExpectedResult = false)]
35+
[TestCase("test", UriKind.Absolute, ExpectedResult = false)]
36+
[TestCase("", UriKind.Absolute, ExpectedResult = false)]
37+
[TestCase(null, UriKind.Absolute, ExpectedResult = false)]
38+
[TestCase("this is not welformed", UriKind.Absolute, ExpectedResult = false)]
39+
[TestCase("ftp://hello.com/", UriKind.Relative, ExpectedResult = false)]
40+
[TestCase("file:///hello.com/", UriKind.Relative, ExpectedResult = false)]
41+
[TestCase("ws://hello.com/", UriKind.Relative, ExpectedResult = false)]
42+
[TestCase("wss://hello.com/", UriKind.Relative, ExpectedResult = false)]
43+
[TestCase("https://hello.com:8080/", UriKind.Relative, ExpectedResult = false)]
44+
[TestCase("http://hello.com:8080/", UriKind.Relative, ExpectedResult = false)]
45+
[TestCase("https://hello.com/path", UriKind.Relative, ExpectedResult = false)]
46+
[TestCase("http://hello.com/path", UriKind.Relative, ExpectedResult = false)]
47+
[TestCase("https://hello.com/path?query=param", UriKind.Relative, ExpectedResult = false)]
48+
[TestCase("http://hello.com/path?query=param", UriKind.Relative, ExpectedResult = false)]
49+
[TestCase("https://hello.com/path#fragment", UriKind.Relative, ExpectedResult = false)]
50+
[TestCase("http://hello.com/path#fragment", UriKind.Relative, ExpectedResult = false)]
51+
[TestCase("https://hello.com/path?query=param#fragment", UriKind.Relative, ExpectedResult = false)]
52+
[TestCase("http://hello.com/path?query=param#fragment", UriKind.Relative, ExpectedResult = false)]
53+
[TestCase("https://hello.com:8080/path?query=param#fragment", UriKind.Relative, ExpectedResult = false)]
54+
[TestCase("http://hello.com:8080/path?query=param#fragment", UriKind.Relative, ExpectedResult = false)]
55+
[TestCase("//hello.com:8080/path?query=param#fragment", UriKind.Relative, ExpectedResult = false)]
56+
[TestCase("//hello.com:8080/path", UriKind.Relative, ExpectedResult = false)]
57+
[TestCase("//hello.com:8080", UriKind.Relative, ExpectedResult = false)]
58+
[TestCase("//hello.com", UriKind.Relative, ExpectedResult = false)]
59+
[TestCase("/test/test.jpg", UriKind.Relative, ExpectedResult = true)]
60+
[TestCase("/test", UriKind.Relative, ExpectedResult = true)]
61+
[TestCase("test", UriKind.Relative, ExpectedResult = true)]
62+
[TestCase("", UriKind.Relative, ExpectedResult = false)]
63+
[TestCase(null, UriKind.Relative, ExpectedResult = false)]
64+
[TestCase("this is not welformed", UriKind.Relative, ExpectedResult = false)]
65+
[TestCase("ftp://hello.com/", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
66+
[TestCase("file:///hello.com/", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
67+
[TestCase("ws://hello.com/", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
68+
[TestCase("wss://hello.com/", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
69+
[TestCase("https://hello.com:8080/", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
70+
[TestCase("http://hello.com:8080/", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
71+
[TestCase("https://hello.com/path", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
72+
[TestCase("http://hello.com/path", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
73+
[TestCase("https://hello.com/path?query=param", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
74+
[TestCase("http://hello.com/path?query=param", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
75+
[TestCase("https://hello.com/path#fragment", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
76+
[TestCase("http://hello.com/path#fragment", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
77+
[TestCase("https://hello.com/path?query=param#fragment", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
78+
[TestCase("http://hello.com/path?query=param#fragment", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
79+
[TestCase("https://hello.com:8080/path?query=param#fragment", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
80+
[TestCase("http://hello.com:8080/path?query=param#fragment", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
81+
[TestCase("//hello.com:8080/path?query=param#fragment", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
82+
[TestCase("//hello.com:8080/path", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
83+
[TestCase("//hello.com:8080", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
84+
[TestCase("//hello.com", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
85+
[TestCase("/test/test.jpg", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
86+
[TestCase("/test", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
87+
[TestCase("test", UriKind.RelativeOrAbsolute, ExpectedResult = true)]
88+
[TestCase("", UriKind.RelativeOrAbsolute, ExpectedResult = false)]
89+
[TestCase(null, UriKind.RelativeOrAbsolute, ExpectedResult = false)]
90+
[TestCase("this is not welformed", UriKind.RelativeOrAbsolute, ExpectedResult = false)]
91+
public bool IsWellFormedWebPath(string? webPath, UriKind uriKind)
92+
{
93+
return WebPath.IsWellFormedWebPath(webPath, uriKind);
94+
}
95+
96+
}
97+
}

‎src/Umbraco.Tests/Umbraco.Tests.csproj

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@
170170
<Compile Include="PublishedContent\NuCacheTests.cs" />
171171
<Compile Include="Routing\MediaUrlProviderTests.cs" />
172172
<Compile Include="Routing\RoutableDocumentFilterTests.cs" />
173+
<Compile Include="Routing\WebPathTests.cs" />
173174
<Compile Include="Runtimes\StandaloneTests.cs" />
174175
<Compile Include="Routing\GetContentUrlsTests.cs" />
175176
<Compile Include="Scheduling\ContentVersionCleanup_Tests_UnitTests.cs" />

‎src/Umbraco.Web/Editors/ImagesController.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
using Umbraco.Core.IO;
99
using Umbraco.Core.Models;
1010
using Umbraco.Web.Mvc;
11+
using Umbraco.Web.Routing;
1112
using Umbraco.Web.WebApi;
1213

1314
namespace Umbraco.Web.Editors
@@ -102,7 +103,7 @@ public HttpResponseMessage GetResized(string imagePath, int width)
102103
private bool IsAllowed(string encodedImagePath)
103104
{
104105

105-
if(Uri.IsWellFormedUriString(encodedImagePath, UriKind.Relative))
106+
if(WebPath.IsWellFormedWebPath(encodedImagePath, UriKind.Relative))
106107
{
107108
return true;
108109
}

‎src/Umbraco.Web/Routing/WebPath.cs

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
using System.Threading.Tasks;
6+
7+
namespace Umbraco.Web.Routing
8+
{
9+
public class WebPath
10+
{
11+
/// <summary>
12+
/// Determines whether the provided web path is well-formed according to the specified UriKind.
13+
/// </summary>
14+
/// <param name="webPath">The web path to check. This can be null.</param>
15+
/// <param name="uriKind">The kind of Uri (Absolute, Relative, or RelativeOrAbsolute).</param>
16+
/// <returns>
17+
/// true if <paramref name="webPath"/> is well-formed; otherwise, false.
18+
/// </returns>
19+
public static bool IsWellFormedWebPath(string? webPath, UriKind uriKind)
20+
{
21+
if (string.IsNullOrWhiteSpace(webPath))
22+
{
23+
return false;
24+
}
25+
26+
if (webPath.StartsWith("//"))
27+
{
28+
return uriKind is not UriKind.Relative;
29+
}
30+
31+
return Uri.IsWellFormedUriString(webPath, uriKind);
32+
}
33+
}
34+
}

‎src/Umbraco.Web/Umbraco.Web.csproj

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,7 @@
325325
<Compile Include="Routing\IPublishedRouter.cs" />
326326
<Compile Include="Routing\MediaUrlProviderCollection.cs" />
327327
<Compile Include="Routing\MediaUrlProviderCollectionBuilder.cs" />
328+
<Compile Include="Routing\WebPath.cs" />
328329
<Compile Include="Scheduling\ContentVersionCleanup.cs" />
329330
<Compile Include="Scheduling\SimpleTask.cs" />
330331
<Compile Include="Scheduling\TempFileCleanup.cs" />

0 commit comments

Comments
 (0)