Project

General

Profile

Actions

Bug #13425

closed

Invalid alias name can still be used by code attempting to validate URL table content

Added by Jim Pingle over 2 years ago. Updated almost 2 years ago.

Status:
Resolved
Priority:
High
Assignee:
Category:
Aliases / Tables
Target version:
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
23.01
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

When validating an alias on save, the name is checked for validity, however the name is still used during validation by process_alias_urltable().

The name is used as-is for a filename which means it may include invalid components such as ../, | and other characters to traverse paths and create arbitrary files.

Actions

Also available in: Atom PDF