51 lines
1.0 KiB
Plaintext
51 lines
1.0 KiB
Plaintext
|
== How to fix it in Multer
|
||
|
|
|
||
|
|
=== Code examples
|
||
|
|
|
||
|
|
==== Noncompliant code example
|
||
|
|
|
||
|
|
The following code sample is vulnerable because it implicitly uses `/tmp` or
|
||
|
|
`/var/tmp` as upload directory.
|
||
|
|
|
||
|
|
[source,javascript,diff-id=2,diff-type=noncompliant]
|
||
|
|
----
|
||
|
|
const crypto = require('node:crypto');
|
||
|
|
const multer = require('multer');
|
||
|
|
|
||
|
|
let diskStorage = multer.diskStorage({
|
||
|
|
filename: (req, file, cb) => {
|
||
|
|
const buf = crypto.randomBytes(20);
|
||
|
|
cb(null, buf.toString('hex'))
|
||
|
|
}
|
||
|
|
}); // Noncompliant
|
||
|
|
|
||
|
|
let diskUpload = multer({
|
||
|
|
storage: diskStorage,
|
||
|
|
});
|
||
|
|
----
|
||
|
|
|
||
|
|
==== Compliant code example
|
||
|
|
|
||
|
|
[source,javascript,diff-id=2,diff-type=compliant]
|
||
|
|
----
|
||
|
|
const multer = require('multer');
|
||
|
|
|
||
|
|
let diskStorage = multer.diskStorage({
|
||
|
|
filename: (req, file, cb) => {
|
||
|
|
const buf = crypto.randomBytes(20);
|
||
|
|
cb(null, buf.toString('hex'))
|
||
|
|
},
|
||
|
|
destination: (req, file, cb) => {
|
||
|
|
cb(null, '/uploads/')
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
let diskUpload = multer({
|
||
|
|
storage: diskStorage,
|
||
|
|
});
|
||
|
|
----
|
||
|
|
|
||
|
|
=== How does this work?
|
||
|
|
|
||
|
|
include::../../common/fix/allowed-folder.adoc[]
|