Merge pull request #17897 from owncloud/backport-scan-check-path-stable8

[stable8] Backport scan check path stable8

2 files changed, 31 insertions, 0 deletions

diff --git a/lib/private/files/utils/scanner.php b/lib/private/files/utils/scanner.php
index 662d4ac03c7..d04dbd2bd72 100644
--- a/lib/private/files/utils/scanner.php
+++ b/lib/private/files/utils/scanner.php
@@ -115,6 +115,9 @@ class Scanner extends PublicEmitter {
 	 * @throws \OC\ForbiddenException
 	 */
 	public function scan($dir = '') {
+		if (!Filesystem::isValidPath($dir)) {
+			throw new \InvalidArgumentException('Invalid path to scan');
+		}
 		$mounts = $this->getMounts($dir);
 		foreach ($mounts as $mount) {
 			if (is_null($mount->getStorage())) {
diff --git a/tests/lib/files/utils/scanner.php b/tests/lib/files/utils/scanner.php
index 65ddfe47514..67282713731 100644
--- a/tests/lib/files/utils/scanner.php
+++ b/tests/lib/files/utils/scanner.php
@@ -150,4 +150,32 @@ class Scanner extends \Test\TestCase {
 		$newInfo = $cache->get('');
 		$this->assertNotEquals($oldInfo['etag'], $newInfo['etag']);
 	}
+
+	/**
+	 * @return array
+	 */
+	public function invalidPathProvider() {
+		return [
+			[
+				'../',
+			],
+			[
+				'..\\',
+			],
+			[
+				'../..\\../',
+			],
+		];
+	}
+
+	/**
+	 * @dataProvider invalidPathProvider
+	 * @expectedException \InvalidArgumentException
+	 * @expectedExceptionMessage Invalid path to scan
+	 * @param string $invalidPath
+	 */
+	public function testInvalidPathScanning($invalidPath) {
+		$scanner = new TestScanner('', \OC::$server->getDatabaseConnection());
+		$scanner->scan($invalidPath);
+	}
 }