From f06c6bb20c0edb9a7dc332c897cca5b06a168a5e Mon Sep 17 00:00:00 2001 From: Jake Spurlock Date: Mon, 14 Oct 2019 15:29:25 +0000 Subject: [PATCH] Filesystem API: Prevent directory travelersals when creating new folders. Reject file paths that contain sub-directory paths. Props iandunn, xknown, sstoqnov, whyisjake. git-svn-id: https://develop.svn.wordpress.org/trunk@46476 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/functions.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index 979536f751..7db3bbafd9 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -1923,6 +1923,11 @@ function wp_mkdir_p( $target ) { return @is_dir( $target ); } + // Do not allow path traversals. + if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) { + return false; + } + // We need to find the permissions of the parent folder that exists and inherit that. $target_parent = dirname( $target ); while ( '.' != $target_parent && ! is_dir( $target_parent ) && dirname( $target_parent ) !== $target_parent ) {