added base path filter

pkg/fs/file.go

@@ -54,6 +54,10 @@ func (fs *Filesystem) NewFile(r io.Reader, path, orig, name string) (newfile str
 		name = orig
 	}
 	newfile = filepath.Join(path, name)
+	err = checkPath(newfile)
+	if err != nil {
+		return
+	}
 	f, err := os.OpenFile(filepath.Join(fs.Base, newfile), os.O_RDWR|os.O_CREATE, FileMode)
 	if err != nil {
 		return
@@ -64,7 +68,12 @@ func (fs *Filesystem) NewFile(r io.Reader, path, orig, name string) (newfile str
 }
 
 func (fs *Filesystem) Mkdir(path, name string) error {
-	return os.Mkdir(filepath.Join(fs.Base, Clean(path), Clean(name)), DirMode)
+	dirpath := filepath.Join(Clean(path), Clean(name))
+	err := checkPath(dirpath)
+	if err != nil {
+		return err
+	}
+	return os.Mkdir(filepath.Join(fs.Base, dirpath), DirMode)
 }
 
 func (fs *Filesystem) Move(path, dest, name string) (string, error) {
@@ -75,7 +84,11 @@ func (fs *Filesystem) Move(path, dest, name string) (string, error) {
 	if fullpath == fs.Base {
 		return "", errors.New("the root path can not be moved")
 	}
-	newfile := Clean(filepath.Join(dest, name))
+	newfile := filepath.Join(Clean(dest), Clean(name))
+	err := checkPath(newfile)
+	if err != nil {
+		return "", err
+	}
 	return newfile, os.Rename(fullpath, filepath.Join(fs.Base, newfile))
 }
 

pkg/fs/helper.go

@@ -1,6 +1,11 @@
 package fs
 
-import "path/filepath"
+import (
+	"errors"
+	"git.giftfish.de/ston1th/docstore/pkg/core"
+	"path/filepath"
+	"strings"
+)
 
 const sep = "/"
 
@@ -12,3 +17,27 @@ func File(path string) string {
 	_, f := filepath.Split(Clean(path))
 	return f
 }
+
+var reserved = []string{
+	core.TotpURI,
+	core.LoginURI,
+	core.LogoutURI,
+	core.RawPrefix,
+	core.IndexPrefix,
+	core.UploadPrefix,
+	core.NewPrefix,
+	core.MovePrefix,
+	core.DeletePrefix,
+	core.Favicon,
+	core.BootstrapCSS,
+	core.CustomCSS,
+}
+
+func checkPath(path string) error {
+	for _, p := range reserved {
+		if strings.HasPrefix(path, p) {
+			return errors.New("base path '" + p + "' is reserved")
+		}
+	}
+	return nil
+}