fix CVE-2022-41417.

But GetDirectory() will create folder if not exists by design. The problem exists in ~/App_Data/Files/<here> despite this fix.
Hoan17122003 · Oct 24, 2022 · 9a8a7e3 · 9a8a7e3
1 parent 61daddf
commit 9a8a7e3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/BlogEngine/BlogEngine.Core/Providers/FileSystemProviders/XmlFileSystemProvider.cs b/BlogEngine/BlogEngine.Core/Providers/FileSystemProviders/XmlFileSystemProvider.cs
@@ -28,7 +28,7 @@ private static string BlogAbsolutePath(string VirtualPath)
         private static string RelativeFilePath(string VirtualPath)
         {
             VirtualPath = VirtualPath.Replace("//","/").Trim();
-            if (VirtualPath.ToLower().Contains(FileContainerRoot.ToLower()))
+            if (VirtualPath.ToLower().Contains(FileContainerRoot.ToLower()+"/") || VirtualPath.ToLower() == FileContainerRoot.ToLower())
                 return VirtualPath;
 
             // ex: Oct 18 2012, added this to handle the case on the File Manager where if