Check for encoded paths

2026-04-26 14:05:27 +01:00 · 2026-04-26 14:05:27 +01:00 · f5cb817d40
parent 73a5c0705a
commit f5cb817d40
1 changed files with 5 additions and 0 deletions
--- a/utils.py
+++ b/utils.py
@ -4144,6 +4144,11 @@ def check_bad_path(path: str):
    """
    path_lower = path.lower()

+    if '%' in path:
+        sections = path.split('%')
+        if len(sections) > 1:
+            return True
+
    bad_strings = [
        '..', '/.', '%2e%2e', '%252e%252e', '/sftp.', '/sftp-', '/statistics',
        '/config/', 'settings.', 'credentials', '/packs/', '/backend/',