Skip to content
Snippets Groups Projects
Unverified Commit 55928d91 authored by sandtechnology's avatar sandtechnology Committed by GitHub
Browse files

[Security][Bugfix] Fix directory traversal exploit (#1907)

* [Security][Bugfix] Fix directory traversal exploit

1.The first slash will act as root path when resolving local path, so directory traversal is possible
2.Filter the illegal payload to prevent directory traversal
3.This also fix the bug about not loading the files in data folder when querying  `/hk4e/announcement/`

* Fix formatting

* Update src/main/java/emu/grasscutter/server/http/handlers/AnnouncementsHandler.java
parent 6219902e
Branches
Tags
No related merge requests found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment