mirror/go-pulse
1
0
Fork 0
mirror of https://gitlab.com/pulsechaincom/go-pulse.git synced 2024-12-25 12:57:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #20019 from holiman/minor_adminfix

Browse Source 
eth: disallow overwrite files via admin.exportChain
This commit is contained in:
Péter Szilágyi 2019-08-30 15:35:43 +03:00 committed by GitHub
commit d5bd38384c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
eth/api.go
View File

@ -168,6 +168,11 @@ func NewPrivateAdminAPI(eth *Ethereum) *PrivateAdminAPI {
// ExportChain exports the current blockchain into a local file.
func (api *PrivateAdminAPI) ExportChain(file string) (bool, error) {
if _, err := os.Stat(file); err == nil {
// File already exists. Allowing overwrite could be a DoS vecotor,
// since the 'file' may point to arbitrary paths on the drive
return false, errors.New("location would overwrite an existing file")
}
// Make sure we can create the file to export into
out, err := os.OpenFile(file, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.ModePerm)
if err != nil {