Skip to content

Commit fb5ca55

Browse files
author
hwyu@adobe.com
committed
MC-41488: Directory write update
- Added extra validation
1 parent dfb2e2a commit fb5ca55

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

lib/internal/Magento/Framework/Filesystem/Directory/DenyListPathValidator.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,14 +59,18 @@ public function validate(
5959
$path,
6060
$scheme
6161
);
62+
if (!$absolutePath) {
63+
$actualPath = $this->driver->getRealPathSafety($fullPath);
64+
} else {
65+
$actualPath = $this->driver->getRealPathSafety($path);
66+
}
6267

63-
// Bypass deny list if in exception list.
6468
if (in_array($fullPath, $this->exceptionList, true)) {
6569
return;
6670
}
6771

6872
foreach ($this->fileDenyList as $file) {
69-
$baseName = pathinfo($fullPath, PATHINFO_BASENAME);
73+
$baseName = pathinfo($actualPath, PATHINFO_BASENAME);
7074
if (str_contains($baseName, $file) || preg_match('#' . "\." . $file . '#', $fullPath)) {
7175
throw new ValidatorException(
7276
new Phrase('"%1" is not a valid file path', [$path])

0 commit comments

Comments
 (0)