uploadlayer.go

package httpserver

import (
	"errors"
	"io"
	"net/http"
	"os"
	"path"
	"path/filepath"
	"strings"

	"github.com/projectdiscovery/gologger"
	"github.com/projectdiscovery/simplehttpserver/pkg/unit"
)

// uploadlayer handles PUT requests and save the file to disk
func (t *HTTPServer) uploadlayer(handler http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Handles file write if enabled
		if EnableUpload && r.Method == http.MethodPut {
			// sandbox - calcolate absolute path
			if t.options.Sandbox {
				absPath, err := filepath.Abs(filepath.Join(t.options.Folder, r.URL.Path))
				if err != nil {
					gologger.Print().Msgf("%s\n", err)
					w.WriteHeader(http.StatusBadRequest)
					return
				}
				// check if the path is within the configured folder
				pattern := t.options.Folder + string(filepath.Separator) + "*"
				matched, err := filepath.Match(pattern, absPath)
				if err != nil {
					gologger.Print().Msgf("%s\n", err)
					w.WriteHeader(http.StatusBadRequest)
					return
				} else if !matched {
					gologger.Print().Msg("pointing to unauthorized directory")
					w.WriteHeader(http.StatusBadRequest)
					return
				}
			}

			var (
				data []byte
				err  error
			)
			if t.options.Sandbox {
				maxFileSize := unit.ToMb(t.options.MaxFileSize)
				// check header content length
				if r.ContentLength > maxFileSize {
					gologger.Print().Msg("request too large")
					return
				}
				// body max length
				r.Body = http.MaxBytesReader(w, r.Body, maxFileSize)
			}

			data, err = io.ReadAll(r.Body)
			if err != nil {
				gologger.Print().Msgf("%s\n", err)
				w.WriteHeader(http.StatusInternalServerError)
				return
			}

			sanitizedPath := filepath.FromSlash(path.Clean("/" + strings.Trim(r.URL.Path, "/")))

			err = handleUpload(t.options.Folder, sanitizedPath, data)
			if err != nil {
				gologger.Print().Msgf("%s\n", err)
				w.WriteHeader(http.StatusInternalServerError)
				return
			} else {
				w.WriteHeader(http.StatusCreated)
				return
			}
		}

		handler.ServeHTTP(w, r)
	})
}

func handleUpload(base, file string, data []byte) error {
	// rejects all paths containing a non exhaustive list of invalid characters - This is only a best effort as the tool is meant for development
	if strings.ContainsAny(file, "\\`\"':") {
		return errors.New("invalid character")
	}

	untrustedPath := filepath.Clean(filepath.Join(base, file))
	if !strings.HasPrefix(untrustedPath, filepath.Clean(base)) {
		return errors.New("invalid path")
	}
	trustedPath := untrustedPath

	if _, err := os.Stat(filepath.Dir(trustedPath)); os.IsNotExist(err) {
		return errors.New("invalid path")
	}

	return os.WriteFile(trustedPath, data, 0655)
}