Validate filename is mongoId before we load it as profile #648

2025-10-21 16:52:23 +01:00
parent 65aa47b0a2
commit 813e00479d
1 changed files with 6 additions and 1 deletions
@@ -70,7 +70,12 @@ public class SaveServer(
        var stopwatch = Stopwatch.StartNew();
        foreach (var file in files)
        {
-            await LoadProfileAsync(fileUtil.StripExtension(file));
+            // Only allow files that fit the criteria of being a mongo id be parsed
+            var filename = Path.GetFileNameWithoutExtension(file);
+            if (MongoId.IsValidMongoId(filename))
+            {
+                await LoadProfileAsync(fileUtil.StripExtension(file));
+            }
        }

        stopwatch.Stop();