fix issue 240: Arbitrary File Deletion vulnerability in task API'

2021-12-27 17:02:22 +08:00 · 2021-12-27 17:02:22 +08:00 · 2618bd4bc9
commit 2618bd4bc9
parent 9ab37a3b87
1 changed files with 1 additions and 1 deletions
--- a/apis/process/task.go
+++ b/apis/process/task.go
@ -198,7 +198,7 @@ func UpdateTask(c *gin.Context) {
 // 删除任务
 func DeleteTask(c *gin.Context) {
 	fullName := c.DefaultQuery("full_name", "")
-	if fullName == "" {
+	if fullName == "" || Strings.Contains(fullName, "/") {
 		app.Error(c, -1, errors.New("参数不正确，请确定参数full_name是否传递"), "")
 		return
 	}