diff --git a/server/controllers/FileSystemController.js b/server/controllers/FileSystemController.js index edfd869c3..7629f9ee2 100644 --- a/server/controllers/FileSystemController.js +++ b/server/controllers/FileSystemController.js @@ -89,6 +89,7 @@ class FileSystemController { } const { directory, folderPath } = req.body + if (!directory?.length || typeof directory !== 'string' || !folderPath?.length || typeof folderPath !== 'string') { Logger.error(`[FileSystemController] Invalid request body: ${JSON.stringify(req.body)}`) return res.status(400).json({ @@ -108,8 +109,7 @@ class FileSystemController { return res.sendStatus(404) } - const filepath = Path.join(libraryFolder.path, directory) - + const filepath = Path.posix.join(libraryFolder.path, directory) // Ensure filepath is inside library folder (prevents directory traversal) if (!filepath.startsWith(libraryFolder.path)) { Logger.error(`[FileSystemController] Filepath is not inside library folder: ${filepath}`)