File Upload API template parameter validation fix with PoC code

漏洞关键信息总结 漏洞概述 类型：API 上传预检（pre-flight）中模板参数未正确校验，可能导致文件上传逻辑异常或权限绕过。 提交信息： 提交者：Bastian Allgaier 提交哈希： 影响范围 涉及文件： - - - - - 影响模块：文件上传 API 的预检流程，涉及 参数处理与权限检查。 修复方案 1. ：在 回调中增加对 参数的校验，确保其值合法（ ），避免非法模板导致上传失败或异常。 2. ：在用户相关路由中同步修复 参数处理逻辑。 3. ：在 函数中，当 为 时，使用默认值（ ）作为父级，避免空值导致的错误。 4. ：在 方法中，对 参数进行非空校验，若为 则使用默认模板。 5. ： - 在构造函数中初始化 属性。 - 在 方法中，对 参数进行校验，若为 则使用默认模板。 - 在 方法中，对 参数进行非空校验，若为 则使用默认模板。 POC/利用代码 `` files.php upload template` 参数的校验 $callback = function ($source, $filename) use ($spare) { $spare = $this->uploadParent($spare) ?? null; $template = $spare['template'] ?? null; $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception( message: 'The file could not be uploaded' ); } return $spare->upload( callback: function ($source, $filename, $template) use ($spare, $spare) { $groups = [ 'source' => $source, 'template' => $template, 'filename' => $filename, ]; // move the source file from the temp dir $file = $spare->createFile($groups, move: true); if ($file instanceof File === false) { throw new Exception(

目標達成すべての支援者に感謝 — 100%達成しました！

File Upload API template parameter validation fix with PoC code

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

File Upload API template parameter validation fix with PoC code

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！