eric/Crosspoint
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Crash on invalid font filename (#2253)

Browse Source 
Co-authored-by: Julia <julia@uxj.io>
This commit is contained in:
Uri Tauber
2026-06-04 10:34:34 -04:00
committed by GitHub
co-authored by Julia
parent f055fdd774
commit a60f31cdd4
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/network/CrossPointWebServer.cpp
+5 -1
View File
@@ -1763,6 +1763,9 @@ void CrossPointWebServer::handleFontUploadData() {
case UPLOAD_FILE_START: { case UPLOAD_FILE_START: {
esp_task_wdt_reset(); esp_task_wdt_reset();
String family = server->arg("family"); String family = server->arg("family");
fontUpload.file = HalFile();
fontUpload.familyName.clear();
fontUpload.filePath.clear();
fontUpload.valid = false; fontUpload.valid = false;
fontUpload.magicChecked = false; fontUpload.magicChecked = false;
fontUpload.bytesWritten = 0; fontUpload.bytesWritten = 0;
@@ -1774,6 +1777,7 @@ void CrossPointWebServer::handleFontUploadData() {
} }
String filename = upload.filename; String filename = upload.filename;
filename.replace(' ', '_');
// Validate filename: rejects path traversal (../, /, \) and enforces // Validate filename: rejects path traversal (../, /, \) and enforces
// a .cpfont basename of alphanumeric + hyphen + underscore. Without // a .cpfont basename of alphanumeric + hyphen + underscore. Without
// this an attacker could supply "../../.crosspoint/settings.json" as // this an attacker could supply "../../.crosspoint/settings.json" as
@@ -1848,7 +1852,7 @@ void CrossPointWebServer::handleFontUploadData() {
fontUpload.bytesWritten += fontUpload.bufferPos; fontUpload.bytesWritten += fontUpload.bufferPos;
fontUpload.bufferPos = 0; fontUpload.bufferPos = 0;
} }
if (fontUpload.file) { if (fontUpload.file.isOpen()) {
fontUpload.file.close(); fontUpload.file.close();
} }