From 8683ee08e7755e5a750f265b0387bfdfe144ea42 Mon Sep 17 00:00:00 2001 From: Claudio Cambra Date: Tue, 25 Oct 2022 15:56:53 +0200 Subject: [PATCH] Validate edit locally token before sending to server Signed-off-by: Claudio Cambra --- src/gui/folderman.cpp | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/gui/folderman.cpp b/src/gui/folderman.cpp index 00818e80a..da1785897 100644 --- a/src/gui/folderman.cpp +++ b/src/gui/folderman.cpp @@ -1513,7 +1513,18 @@ void FolderMan::editFileLocally(const QString &userId, const QString &relPath, c showError(accountFound, tr("Could not find a folder to sync."), relPath); return; } - + + // Token is an alphanumeric string 128 chars long. + // Ensure that is what we received and what we are sending to the server. + const QRegularExpression tokenRegex("^[a-zA-Z0-9]{128}$"); + const auto regexMatch = tokenRegex.match(token); + + // Means invalid token type received, be cautious with bad token + if(!regexMatch.hasMatch()) { + showError(accountFound, tr("Invalid token received."), tr("Please try again.")); + return; + } + const auto relPathSplit = relPath.split(QLatin1Char('/')); if (relPathSplit.size() > 0) { Systray::instance()->createEditFileLocallyLoadingDialog(relPathSplit.last()); @@ -1522,7 +1533,9 @@ void FolderMan::editFileLocally(const QString &userId, const QString &relPath, c return; } - const auto checkTokenForEditLocally = new SimpleApiJob(accountFound->account(), QStringLiteral("/ocs/v2.php/apps/files/api/v1/openlocaleditor/%1").arg(token)); + // Sanitise the token + const auto encodedToken = QString(QUrl::toPercentEncoding(token)); + const auto checkTokenForEditLocally = new SimpleApiJob(accountFound->account(), QStringLiteral("/ocs/v2.php/apps/files/api/v1/openlocaleditor/%1").arg(encodedToken)); checkTokenForEditLocally->setVerb(SimpleApiJob::Verb::Post); checkTokenForEditLocally->setBody(QByteArray{"path=/"}.append(relPath.toUtf8())); connect(checkTokenForEditLocally, &SimpleApiJob::resultReceived, checkTokenForEditLocally, [this, folderForFile, localFilePath, showError, accountFound, relPath] (int statusCode) {