sqz269 / fileshare-flask Goto Github PK

File names that contains , will break the program due to the containing file names are stored in a string and separated by comma. for example a folder contains {"file.txt", "file2.txt", "bad_things, happen.docx"} which is stored like: "file.txt,file2.txt,bad_things, happen.docx". When the program trys to restore it to list via: for file in record.content_file.split(",") it will unfortunately become {"file.txt", "file2.txt", "bad_things", " happen.docs"}.

One solution is to replace , to \0 (null terminated) to separate the file names.

directory traversal can be achieved due to insufficient security measures in make_abs_path_from_url