Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge PR #147

Browse Source 
🛡️ Sentinel: [MEDIUM] Fix TOCTOU vulnerability in file read
This commit is contained in:
Ralksta
2026-05-06 11:59:55 +02:00
committed by GitHub
parent 0aa775a08d 8c573314d6
commit 3e310f142e
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
app/about/page.tsx
View File

@@ -3,7 +3,7 @@
* Reads content from content/about.md (frontmatter + markdown body). * Reads content from content/about.md (frontmatter + markdown body).
*/ */
import { readFileSync } from 'fs'; import { promises as fsPromises } from 'fs';
import { join } from 'path'; import { join } from 'path';
import yaml from 'js-yaml'; import yaml from 'js-yaml';
import Image from 'next/image'; import Image from 'next/image';
@@ -20,12 +20,15 @@ interface AboutFrontmatter {
gear?: string[]; gear?: string[];
} }
function getAboutContent() { async function getAboutContent() {
const filePath = join(process.cwd(), 'content', 'about.md'); const filePath = join(process.cwd(), 'content', 'about.md');
if (!require('fs').existsSync(filePath)) { let raw: string;
try {
raw = await fsPromises.readFile(filePath, 'utf-8');
} catch {
return { meta: {} as AboutFrontmatter, body: '' }; return { meta: {} as AboutFrontmatter, body: '' };
} }
const raw = readFileSync(filePath, 'utf-8');
let meta = {} as AboutFrontmatter; let meta = {} as AboutFrontmatter;
let body = raw; let body = raw;
@@ -44,7 +47,7 @@ function getAboutContent() {
} }
export default async function AboutPage() { export default async function AboutPage() {
const { meta, body } = getAboutContent(); const { meta, body } = await getAboutContent();
// Fetch ThumbHash for portrait placeholder // Fetch ThumbHash for portrait placeholder
const portraitAsset = meta.portrait ? await immich.getAssetInfo(meta.portrait) : null; const portraitAsset = meta.portrait ? await immich.getAssetInfo(meta.portrait) : null;