From 0c8d25b7a3e7a10a506f1e19b868fe9b0c761495 Mon Sep 17 00:00:00 2001
From: fiaxh <git@lightrise.org>
Date: Mon, 7 Jun 2021 09:56:25 -0600
Subject: Fix file traversal issue on incoming file transfers

Fixes CVE-2021-33896
---
 libdino/src/entity/file_transfer.vala | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

(limited to 'libdino')

diff --git a/libdino/src/entity/file_transfer.vala b/libdino/src/entity/file_transfer.vala
index a8e386bf..1823478f 100644
--- a/libdino/src/entity/file_transfer.vala
+++ b/libdino/src/entity/file_transfer.vala
@@ -45,7 +45,18 @@ public class FileTransfer : Object {
         }
     }
 
-    public string file_name { get; set; }
+    private string file_name_;
+    public string file_name {
+        get { return file_name_; }
+        set {
+            file_name_ = Path.get_basename(value);
+            if (file_name_ == Path.DIR_SEPARATOR_S || file_name_ == ".") {
+                file_name_ = "unknown filename";
+            } else if (file_name_.has_prefix(".")) {
+                file_name_ = "_" + file_name_;
+            }
+        }
+    }
     private string? server_file_name_ = null;
     public string server_file_name {
         get { return server_file_name_ ?? file_name; }
-- 
cgit v1.2.3-54-g00ecf