Fixed: Downloading backups when path contains a trailing slash

Closes #8270

.github/workflows/build.yml

@@ -22,7 +22,7 @@ env:
   FRAMEWORK: net6.0
   RAW_BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
   SONARR_MAJOR_VERSION: 4
-  VERSION: 4.0.16
+  VERSION: 4.0.17
 
 jobs:
   backend:

src/NzbDrone.Core/Extras/Metadata/Consumers/Plex/PlexMetadata.cs

@@ -73,7 +73,7 @@ namespace NzbDrone.Core.Extras.Metadata.Consumers.Plex
 
                     if (episodeFile.SeasonNumber == 0)
                     {
-                        episodeFormat = $"SP{episodesInFile.First():00}";
+                        episodeFormat = $"SP{episodesInFile.First().EpisodeNumber:00}";
                     }
 
                     content.AppendLine($"Episode: {episodeFormat}: {episodeFile.RelativePath}");

src/NzbDrone.Core/Extras/Metadata/Consumers/Xbmc/XbmcMetadata.cs

@@ -286,20 +286,20 @@ namespace NzbDrone.Core.Extras.Metadata.Consumers.Xbmc
 
             var watched = GetExistingWatchedStatus(series, episodeFile.RelativePath);
 
-            var xmlResult = string.Empty;
             var xws = new XmlWriterSettings
             {
                 Encoding = Encoding.UTF8,
-                Indent = true
+                Indent = true,
+                ConformanceLevel =  ConformanceLevel.Fragment
             };
 
+            using var sw = new Utf8StringWriter();
+            using var xw = XmlWriter.Create(sw, xws);
+
+            xw.WriteProcessingInstruction("xml", "version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"");
+
             foreach (var episode in episodeFile.Episodes.Value)
             {
-                var doc = new XDocument
-                {
-                    Declaration = new XDeclaration("1.0", "UTF-8", "yes")
-                };
-
                 var image = episode.Images.SingleOrDefault(i => i.CoverType == MediaCoverTypes.Screenshot);
 
                 var details = new XElement("episodedetails");
@@ -391,17 +391,12 @@ namespace NzbDrone.Core.Extras.Metadata.Consumers.Xbmc
                 // details.Add(new XElement("credits", tvdbEpisode.Writer.FirstOrDefault()));
                 // details.Add(new XElement("director", tvdbEpisode.Directors.FirstOrDefault()));
 
-                using var sw = new Utf8StringWriter();
+                details.WriteTo(xw);
-                using var xw = XmlWriter.Create(sw, xws);
-
-                doc.Add(details);
-                doc.Save(xw);
-                xw.Flush();
-
-                xmlResult += sw.ToString();
-                xmlResult += Environment.NewLine;
             }
 
+            xw.Flush();
+            var xmlResult = sw.ToString();
+
             return new MetadataFileResult(GetEpisodeMetadataFilename(episodeFile.RelativePath), xmlResult.Trim(Environment.NewLine.ToCharArray()));
         }
 

src/NzbDrone.Core/Sonarr.Core.csproj

@@ -20,7 +20,7 @@
     <PackageReference Include="Servarr.FluentMigrator.Runner.SQLite" Version="3.3.2.9" />
     <PackageReference Include="Servarr.FluentMigrator.Runner.Postgres" Version="3.3.2.9" />
     <PackageReference Include="FluentValidation" Version="9.5.4" />
-    <PackageReference Include="SixLabors.ImageSharp" Version="3.1.7" />
+    <PackageReference Include="SixLabors.ImageSharp" Version="3.1.12" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="NLog" Version="5.3.4" />
     <PackageReference Include="MonoTorrent" Version="2.0.7" />

src/NzbDrone.Host/Startup.cs

@@ -63,6 +63,8 @@ namespace NzbDrone.Host
                 options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("10.0.0.0"), 8));
                 options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("172.16.0.0"), 12));
                 options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("192.168.0.0"), 16));
+                options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("fc00::"), 7));
+                options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("fe80::"), 10));
             });
 
             services.AddRouting(options => options.LowercaseUrls = true);

src/Sonarr.Http/Frontend/Mappers/BackupFileMapper.cs

@@ -15,11 +15,13 @@ namespace Sonarr.Http.Frontend.Mappers
             _backupService = backupService;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _backupService.GetBackupFolder().TrimEnd(Path.DirectorySeparatorChar);
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace("/backup/", "").Replace('/', Path.DirectorySeparatorChar);
 
-            return Path.Combine(_backupService.GetBackupFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/BrowserConfig.cs

@@ -8,13 +8,20 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class BrowserConfig : UrlBaseReplacementResourceMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
+        private readonly IConfigFileProvider _configFileProvider;
+
         public BrowserConfig(IAppFolderInfo appFolderInfo, IDiskProvider diskProvider, IConfigFileProvider configFileProvider, Logger logger)
             : base(diskProvider, configFileProvider, logger)
         {
-            FilePath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "Content", "browserconfig.xml");
+            _appFolderInfo = appFolderInfo;
+            _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string FilePath => Path.Combine(FolderPath, "Content", "browserconfig.xml");
+
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Sonarr.Http/Frontend/Mappers/CacheBreakerProvider.cs

@@ -37,6 +37,12 @@ namespace Sonarr.Http.Frontend.Mappers
 
             var mapper = _diskMappers.Single(m => m.CanHandle(resourceUrl));
             var pathToFile = mapper.Map(resourceUrl);
+
+            if (pathToFile == null)
+            {
+                return resourceUrl;
+            }
+
             var hash = _hashProvider.ComputeMd5(pathToFile).ToBase64();
 
             return resourceUrl + "?h=" + hash.Trim('=');

src/Sonarr.Http/Frontend/Mappers/FaviconMapper.cs

@@ -18,7 +18,9 @@ namespace Sonarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var fileName = "favicon.ico";
 
@@ -29,7 +31,7 @@ namespace Sonarr.Http.Frontend.Mappers
 
             var path = Path.Combine("Content", "Images", "Icons", fileName);
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/HtmlMapperBase.cs

@@ -4,6 +4,7 @@ using System.Text.RegularExpressions;
 using NLog;
 using NzbDrone.Common.Disk;
 using NzbDrone.Common.EnvironmentInfo;
+using NzbDrone.Core.Configuration;
 
 namespace Sonarr.Http.Frontend.Mappers
 {
@@ -13,19 +14,22 @@ namespace Sonarr.Http.Frontend.Mappers
         private readonly Lazy<ICacheBreakerProvider> _cacheBreakProviderFactory;
         private static readonly Regex ReplaceRegex = new Regex(@"(?:(?<attribute>href|src)=\"")(?<path>.*?(?<extension>css|js|png|ico|ics|svg|json))(?:\"")(?:\s(?<nohash>data-no-hash))?", RegexOptions.Compiled | RegexOptions.IgnoreCase);
 
+        private string _urlBase;
         private string _generatedContent;
 
         protected HtmlMapperBase(IDiskProvider diskProvider,
+                                 IConfigFileProvider configFileProvider,
                                  Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                  Logger logger)
             : base(diskProvider, logger)
         {
             _diskProvider = diskProvider;
             _cacheBreakProviderFactory = cacheBreakProviderFactory;
+
+            _urlBase = configFileProvider.UrlBase;
         }
 
-        protected string HtmlPath;
+        protected abstract string HtmlPath { get; }
-        protected string UrlBase;
 
         protected override Stream GetContentStream(string filePath)
         {
@@ -62,10 +66,10 @@ namespace Sonarr.Http.Frontend.Mappers
                     url = cacheBreakProvider.AddCacheBreakerToPath(match.Groups["path"].Value);
                 }
 
-                return $"{match.Groups["attribute"].Value}=\"{UrlBase}{url}\"";
+                return $"{match.Groups["attribute"].Value}=\"{_urlBase}{url}\"";
             });
 
-            text = text.Replace("__URL_BASE__", UrlBase);
+            text = text.Replace("__URL_BASE__", _urlBase);
 
             _generatedContent = text;
 

src/Sonarr.Http/Frontend/Mappers/IndexHtmlMapper.cs

@@ -9,6 +9,7 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class IndexHtmlMapper : HtmlMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         public IndexHtmlMapper(IAppFolderInfo appFolderInfo,
@@ -16,15 +17,16 @@ namespace Sonarr.Http.Frontend.Mappers
                                IConfigFileProvider configFileProvider,
                                Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                Logger logger)
-            : base(diskProvider, cacheBreakProviderFactory, logger)
+            : base(diskProvider, configFileProvider, cacheBreakProviderFactory, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-
-            HtmlPath = Path.Combine(appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, "index.html");
-            UrlBase = configFileProvider.UrlBase;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string HtmlPath => Path.Combine(FolderPath, "index.html");
+
+        protected override string MapPath(string resourceUrl)
         {
             return HtmlPath;
         }

src/Sonarr.Http/Frontend/Mappers/LogFileMapper.cs

@@ -16,12 +16,14 @@ namespace Sonarr.Http.Frontend.Mappers
             _appFolderInfo = appFolderInfo;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _appFolderInfo.GetLogFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = Path.GetFileName(path);
 
-            return Path.Combine(_appFolderInfo.GetLogFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/LoginHtmlMapper.cs

@@ -9,6 +9,7 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class LoginHtmlMapper : HtmlMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         public LoginHtmlMapper(IAppFolderInfo appFolderInfo,
@@ -16,14 +17,16 @@ namespace Sonarr.Http.Frontend.Mappers
                                Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                IConfigFileProvider configFileProvider,
                                Logger logger)
-            : base(diskProvider, cacheBreakProviderFactory, logger)
+            : base(diskProvider, configFileProvider, cacheBreakProviderFactory, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-            HtmlPath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "login.html");
-            UrlBase = configFileProvider.UrlBase;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string HtmlPath => Path.Combine(FolderPath, "login.html");
+
+        protected override string MapPath(string resourceUrl)
         {
             return HtmlPath;
         }

src/Sonarr.Http/Frontend/Mappers/ManifestMapper.cs

@@ -8,6 +8,7 @@ namespace Sonarr.Http.Frontend.Mappers
 {
     public class ManifestMapper : UrlBaseReplacementResourceMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         private string _generatedContent;
@@ -15,11 +16,14 @@ namespace Sonarr.Http.Frontend.Mappers
         public ManifestMapper(IAppFolderInfo appFolderInfo, IDiskProvider diskProvider, IConfigFileProvider configFileProvider, Logger logger)
             : base(diskProvider, configFileProvider, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-            FilePath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "Content", "manifest.json");
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string FilePath => Path.Combine(FolderPath, "Content", "manifest.json");
+
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Sonarr.Http/Frontend/Mappers/MediaCoverMapper.cs

@@ -22,7 +22,9 @@ namespace Sonarr.Http.Frontend.Mappers
             _diskProvider = diskProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.GetAppDataPath(), "MediaCover");
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = path.Trim(Path.DirectorySeparatorChar);

src/Sonarr.Http/Frontend/Mappers/RobotsTxtMapper.cs

@@ -18,11 +18,13 @@ namespace Sonarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = Path.Combine("Content", "robots.txt");
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/StaticResourceMapper.cs

@@ -18,12 +18,14 @@ namespace Sonarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = path.Trim(Path.DirectorySeparatorChar);
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/StaticResourceMapperBase.cs

@@ -27,14 +27,28 @@ namespace Sonarr.Http.Frontend.Mappers
             _caseSensitive = RuntimeInfo.IsProduction ? DiskProviderBase.PathStringComparison : StringComparison.OrdinalIgnoreCase;
         }
 
-        public abstract string Map(string resourceUrl);
+        protected abstract string FolderPath { get; }
+        protected abstract string MapPath(string resourceUrl);
 
         public abstract bool CanHandle(string resourceUrl);
 
+        public string Map(string resourceUrl)
+        {
+            var filePath = Path.GetFullPath(MapPath(resourceUrl));
+            var parentPath = Path.GetFullPath(FolderPath) + Path.DirectorySeparatorChar;
+
+            return filePath.StartsWith(parentPath) ? filePath : null;
+        }
+
         public Task<IActionResult> GetResponse(string resourceUrl)
         {
             var filePath = Map(resourceUrl);
 
+            if (filePath == null)
+            {
+                return Task.FromResult<IActionResult>(null);
+            }
+
             if (_diskProvider.FileExists(filePath, _caseSensitive))
             {
                 if (!_mimeTypeProvider.TryGetContentType(filePath, out var contentType))

src/Sonarr.Http/Frontend/Mappers/UpdateLogFileMapper.cs

@@ -16,12 +16,14 @@ namespace Sonarr.Http.Frontend.Mappers
             _appFolderInfo = appFolderInfo;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _appFolderInfo.GetUpdateLogFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = Path.GetFileName(path);
 
-            return Path.Combine(_appFolderInfo.GetUpdateLogFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Sonarr.Http/Frontend/Mappers/UrlBaseReplacementResourceMapperBase.cs

@@ -20,9 +20,9 @@ namespace Sonarr.Http.Frontend.Mappers
             _urlBase = configFileProvider.UrlBase;
         }
 
-        protected string FilePath;
+        protected abstract string FilePath { get; }
 
-        public override string Map(string resourceUrl)
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Sonarr.Http/Frontend/StaticResourceController.cs

@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.Linq;
+using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Cors;
@@ -16,6 +17,7 @@ namespace Sonarr.Http.Frontend
     {
         private readonly IEnumerable<IMapHttpRequestsToDisk> _requestMappers;
         private readonly Logger _logger;
+        private static readonly Regex InvalidPathRegex = new (@"([\/\\]|%2f|%5c)\.\.|\.\.([\/\\]|%2f|%5c)", RegexOptions.IgnoreCase | RegexOptions.Compiled);
 
         public StaticResourceController(IEnumerable<IMapHttpRequestsToDisk> requestMappers,
             Logger logger)
@@ -50,6 +52,11 @@ namespace Sonarr.Http.Frontend
         {
             path = "/" + (path ?? "");
 
+            if (InvalidPathRegex.IsMatch(path))
+            {
+                return NotFound();
+            }
+
             var mapper = _requestMappers.SingleOrDefault(m => m.CanHandle(path));
 
             if (mapper != null)