fix security issues (#1555)

juicedata · Mar 11, 2022 · cf224a1 · cf224a1
1 parent 9033d3b
commit cf224a1
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/pkg/fs/http.go b/pkg/fs/http.go
@@ -127,7 +127,7 @@ func (hfs *webdavFS) Rename(ctx context.Context, oldName, newName string) error
 }
 
 func (hfs *webdavFS) Stat(ctx context.Context, name string) (os.FileInfo, error) {
-	fi, err := hfs.fs.Stat(hfs.ctx, name)
+	fi, err := hfs.fs.Stat(hfs.ctx, removeNewLine(name))
 	return fi, econv(err)
 }
 
@@ -216,3 +216,7 @@ func StartHTTPServer(fs *FileSystem, addr string, gzipEnabled bool, disallowList
 		logger.Fatalf("Error with WebDAV server: %v", err)
 	}
 }
+
+func removeNewLine(input string) string {
+	return strings.Replace(strings.Replace(input, "\n", "", -1), "\r", "", -1)
+}
diff --git a/pkg/object/s3.go b/pkg/object/s3.go
@@ -398,7 +398,7 @@ func newS3(endpoint, accessKey, secretKey string) (ObjectStorage, error) {
 				// compatible s3
 				bucketName = hostParts[0]
 				ep = hostParts[1]
-				oracleCompile := regexp.MustCompile(`.*\\.compat\\.objectstorage\\.(.*)\\.oraclecloud.com`)
+				oracleCompile := regexp.MustCompile(`.*\\.compat\\.objectstorage\\.(.*)\\.oraclecloud\\.com`)
 				if oracleCompile.MatchString(ep) {
 					if submatch := oracleCompile.FindStringSubmatch(ep); len(submatch) == 2 {
 						region = submatch[1]