d8dfun/claudecodeui
1
0
Fork 0
mirror of https://github.com/siteboon/claudecodeui.git synced 2026-05-31 17:35:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Potential fix for code scanning alert no. 312: Uncontrolled data used in path expression

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Simos Mikelatos
2026-03-06 01:16:52 +01:00
committed by GitHub
parent ba197cc286
commit 6d4cea0435
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
server/utils/plugin-loader.js
View File

@@ -146,7 +146,12 @@ export function installPluginFromGit(url) {
} }
const pluginsDir = getPluginsDir(); const pluginsDir = getPluginsDir();
const targetDir = path.join(pluginsDir, repoName); const targetDir = path.resolve(pluginsDir, repoName);
// Ensure the resolved target directory stays within the plugins directory
if (!targetDir.startsWith(pluginsDir + path.sep)) {
return reject(new Error('Invalid plugin directory path'));
}
if (fs.existsSync(targetDir)) { if (fs.existsSync(targetDir)) {
return reject(new Error(`Plugin directory "${repoName}" already exists`)); return reject(new Error(`Plugin directory "${repoName}" already exists`));