9d7eba705a
ServeFile's built-in ".." rejection only covers r.URL.Path, not a path handed to it explicitly from a query param — validate p resolves to a real, regular file before serving.
68 lines
2.2 KiB
Go
68 lines
2.2 KiB
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
)
|
|
|
|
// fileHandler serves device/local files to the webview (used by the Files image
|
|
// viewer) over the Wails asset server. Streaming raw bytes avoids the size
|
|
// limits WebKitGTK imposes on large base64 data: URLs.
|
|
//
|
|
// Route: /__file?src=device|local&p=<path>
|
|
func (a *App) fileHandler() http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
q := r.URL.Query()
|
|
p := q.Get("p")
|
|
if p == "" {
|
|
http.Error(w, "missing path", http.StatusBadRequest)
|
|
return
|
|
}
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
|
|
if q.Get("src") == "local" {
|
|
// ServeFile's built-in ".." rejection only applies to r.URL.Path, not to
|
|
// a path we hand it explicitly — so confirm p resolves to a real,
|
|
// regular file before serving it (blocks traversal to devices/pipes/dirs
|
|
// and nonexistent paths, satisfies CodeQL go/path-injection).
|
|
clean := filepath.Clean(p)
|
|
info, err := os.Stat(clean)
|
|
if err != nil || !info.Mode().IsRegular() {
|
|
http.Error(w, "invalid path", http.StatusBadRequest)
|
|
return
|
|
}
|
|
// ServeFile picks the Content-Type and supports range requests.
|
|
http.ServeFile(w, r, clean)
|
|
return
|
|
}
|
|
|
|
// Device: pull to a temp file via the file-sync protocol, then serve it.
|
|
// `adb pull` takes the remote path as a literal argument (no device-shell
|
|
// re-parsing), so it handles spaces/parens/etc. — unlike `adb exec-out`,
|
|
// which mangles quoted paths. This mirrors the working Pull button.
|
|
adbPath, err := a.getBinaryPath("adb")
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
tmp, err := os.CreateTemp("", "atk-view-*")
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
tmpPath := tmp.Name()
|
|
tmp.Close()
|
|
defer os.Remove(tmpPath)
|
|
|
|
cmd := exec.Command(adbPath, "pull", p, tmpPath)
|
|
setCommandSysProcAttr(cmd)
|
|
if out, err := cmd.CombinedOutput(); err != nil {
|
|
http.Error(w, "failed to read device file: "+string(out), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Type", mimeForName(p))
|
|
http.ServeFile(w, r, tmpPath)
|
|
})
|
|
}
|