{"action":"created","issue":{"url":"https://api.github.com/repos/Chocobozzz/PeerTube/issues/1125","repository_url":"https://api.github.com/repos/Chocobozzz/PeerTube","labels_url":"https://api.github.com/repos/Chocobozzz/PeerTube/issues/1125/labels{/name}","comments_url":"https://api.github.com/repos/Chocobozzz/PeerTube/issues/1125/comments","events_url":"https://api.github.com/repos/Chocobozzz/PeerTube/issues/1125/events","html_url":"https://github.com/Chocobozzz/PeerTube/issues/1125","id":364148230,"node_id":"MDU6SXNzdWUzNjQxNDgyMzA=","number":1125,"title":"Downloads of videos for redundancy create files with arbitrary paths including \"/\"","user":{"login":"scanlime","id":923812,"node_id":"MDQ6VXNlcjkyMzgxMg==","avatar_url":"https://avatars2.githubusercontent.com/u/923812?v=4","gravatar_id":"","url":"https://api.github.com/users/scanlime","html_url":"https://github.com/scanlime","followers_url":"https://api.github.com/users/scanlime/followers","following_url":"https://api.github.com/users/scanlime/following{/other_user}","gists_url":"https://api.github.com/users/scanlime/gists{/gist_id}","starred_url":"https://api.github.com/users/scanlime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scanlime/subscriptions","organizations_url":"https://api.github.com/users/scanlime/orgs","repos_url":"https://api.github.com/users/scanlime/repos","events_url":"https://api.github.com/users/scanlime/events{/privacy}","received_events_url":"https://api.github.com/users/scanlime/received_events","type":"User","site_admin":false},"labels":[{"id":1069971437,"node_id":"MDU6TGFiZWwxMDY5OTcxNDM3","url":"https://api.github.com/repos/Chocobozzz/PeerTube/labels/Component:%20Redundancy","name":"Component: Redundancy","color":"88eaa5","default":false},{"id":387859384,"node_id":"MDU6TGFiZWwzODc4NTkzODQ=","url":"https://api.github.com/repos/Chocobozzz/PeerTube/labels/Type:%20Bug%20:bug:","name":"Type: Bug :bug:","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-09-26T18:08:32Z","updated_at":"2018-09-27T20:17:54Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I'm running v1.0.0-beta14 and I've been experimenting with the redundancy feature.\r\n\r\nThe downloads seem to go directly into the video storage directory with a path that depends on the video title.\r\n\r\nThis is quite possibly a giant security hole... and it's already leaving me with directories inside 'storage' any time it downloads a video with a slash in the title."},"comment":{"url":"https://api.github.com/repos/Chocobozzz/PeerTube/issues/comments/425228612","html_url":"https://github.com/Chocobozzz/PeerTube/issues/1125#issuecomment-425228612","issue_url":"https://api.github.com/repos/Chocobozzz/PeerTube/issues/1125","id":425228612,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNTIyODYxMg==","user":{"login":"scanlime","id":923812,"node_id":"MDQ6VXNlcjkyMzgxMg==","avatar_url":"https://avatars2.githubusercontent.com/u/923812?v=4","gravatar_id":"","url":"https://api.github.com/users/scanlime","html_url":"https://github.com/scanlime","followers_url":"https://api.github.com/users/scanlime/followers","following_url":"https://api.github.com/users/scanlime/following{/other_user}","gists_url":"https://api.github.com/users/scanlime/gists{/gist_id}","starred_url":"https://api.github.com/users/scanlime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scanlime/subscriptions","organizations_url":"https://api.github.com/users/scanlime/orgs","repos_url":"https://api.github.com/users/scanlime/repos","events_url":"https://api.github.com/users/scanlime/events{/privacy}","received_events_url":"https://api.github.com/users/scanlime/received_events","type":"User","site_admin":false},"created_at":"2018-09-27T20:17:54Z","updated_at":"2018-09-27T20:17:54Z","author_association":"CONTRIBUTOR","body":"Thanks for the explanation, I didn't realize path.join() would normalize the resulting path as if it's absolute. This seems safe (albeit annoying) unless there are symlinks or other ways to escape the import directory with a specially written name. Is it still a concern that any filename can be overwritten?"}}
{"actor":{"display_login":"scanlime"}}