From f0971163951b6a1cc2a58d6338edb07c081f2c88 Mon Sep 17 00:00:00 2001 From: dengzhongyuan Date: Mon, 2 Feb 2026 13:09:19 +0800 Subject: [PATCH] fix: add path traversal check in mkTempDir function - Implemented a validation check in the mkTempDir function to reject infix values containing "..", enhancing security against path traversal vulnerabilities. This change improves the robustness of the temporary directory creation process. --- basestruct/utils.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/basestruct/utils.cpp b/basestruct/utils.cpp index 1a18e30..0f39896 100644 --- a/basestruct/utils.cpp +++ b/basestruct/utils.cpp @@ -661,6 +661,14 @@ bool Utils::kernelSupportFS(const QString &fsType) QString Utils::mkTempDir(const QString &infix) { + qDebug() << "Utils::mkTempDir - Creating temp dir with infix:" << infix; + + // 路径遍历检查：拒绝包含 ".." 的 infix + if (infix.contains("..")) { + qWarning() << "Utils::mkTempDir - Invalid infix contains path traversal:" << infix; + return QString(); + } + // Construct template like "/var/tmp/diskmanager-XXXXXX" or "/var/tmp/diskmanager-INFIX-XXXXXX" QString dirTemplate = "/var/tmp/";