Merge pull request from GHSA-p528-555r-pf87

Fix Relative Path Traversal Attack on note creation

1 files changed, 3 insertions, 3 deletions

diff --git a/lib/models/note.js b/lib/models/note.js
index 7b8b6783..0c268e2e 100644
--- a/lib/models/note.js
+++ b/lib/models/note.js
@@ -94,7 +94,7 @@ module.exports = function (sequelize, DataTypes) {
             let body = null
             let filePath = null
             if (note.alias) {
-              filePath = path.join(config.docsPath, note.alias + '.md')
+              filePath = path.join(config.docsPath, path.basename(note.alias) + '.md')
             }
             if (!filePath || !Note.checkFileExist(filePath)) {
               filePath = config.defaultNotePath
@@ -196,7 +196,7 @@ module.exports = function (sequelize, DataTypes) {
           }
         }).then(function (note) {
           if (note) {
-            const filePath = path.join(config.docsPath, noteId + '.md')
+            const filePath = path.join(config.docsPath, path.basename(noteId) + '.md')
             if (Note.checkFileExist(filePath)) {
               // if doc in filesystem have newer modified time than last change time
               // then will update the doc in db
@@ -238,7 +238,7 @@ module.exports = function (sequelize, DataTypes) {
               return callback(null, note.id)
             }
           } else {
-            const filePath = path.join(config.docsPath, noteId + '.md')
+            const filePath = path.join(config.docsPath, path.basename(noteId) + '.md')
             if (Note.checkFileExist(filePath)) {
               Note.create({
                 alias: noteId,