Linus-Enjoyer/Freedom-Loader
1
0
Fork 0
mirror of https://github.com/MasterAcnolo/Freedom-Loader.git synced 2026-07-29 18:25:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Centralize default download path and enhance path validation logic

Browse Source
This commit is contained in:
MasterAcnolo
2026-02-17 23:29:31 +01:00
parent 45e0840fea
commit 32c9a66a35
6 changed files with 94 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
server/helpers/validation.js
View File

@@ -12,10 +12,35 @@ function isValidUrl(url) {
}
function isSafePath(folder) {
if (!folder || folder.length < 3) return false;
const unsafe = ["System32", "/etc", "\\Windows"];
const resolved = path.resolve(folder);
return !unsafe.some(u => resolved.includes(u));
if (!folder || typeof folder !== "string") return false;
try {
// Normalize path and resolve symlinks
const resolved = path.resolve(folder).toLowerCase().replace(/\//g, "\\");
// Block Windows system directories (on any drive)
const unsafePaths = [
"\\windows\\",
"\\system32\\",
"\\program files\\",
"\\program files (x86)\\",
"\\programdata\\",
"\\$recycle.bin\\",
"\\system volume information\\"
];
// Check if path contains any unsafe directory
if (unsafePaths.some(unsafe => resolved.includes(unsafe))) {
return false;
}
// Allow all drives (C:, D:, E:, etc.) but block system folders
return true;
} catch (err) {
// In case of path resolution error
return false;
}
}
module.exports = { isValidUrl, isSafePath };