From 778ae8abd54c378fc4781394bbedc7a2ee3095e1 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Thu, 1 Sep 2016 10:06:06 +0200
Subject: [PATCH 1/3] Filter out %0A from paths

---
 apps/files/js/filelist.js           | 7 ++++++-
 apps/files/tests/js/filelistSpec.js | 3 ++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js
index 681e17d11a..a61f6eaf89 100644
--- a/apps/files/js/filelist.js
+++ b/apps/files/js/filelist.js
@@ -1327,6 +1327,10 @@
 			return OC.linkTo('files', 'index.php')+"?dir="+ encodeURIComponent(dir).replace(/%2F/g, '/');
 		},
 
+		/**
+		 * @param {string} path
+		 * @returns {boolean}
+		 */
 		_isValidPath: function(path) {
 			var sections = path.split('/');
 			for (var i = 0; i < sections.length; i++) {
@@ -1334,7 +1338,8 @@
 					return false;
 				}
 			}
-			return true;
+
+			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1;
 		},
 
 		/**
diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js
index cd37888499..9753e80d18 100644
--- a/apps/files/tests/js/filelistSpec.js
+++ b/apps/files/tests/js/filelistSpec.js
@@ -1333,9 +1333,10 @@ describe('OCA.Files.FileList tests', function() {
 				'/abc/..',
 				'/abc/../',
 				'/../abc/',
+				'/foo%0Abar/',
 				'/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../'
 			], function(path) {
-				fileList.changeDirectory(path);
+				fileList.changeDirectory(decodeURI(path));
 				expect(fileList.getCurrentDirectory()).toEqual('/');
 			});
 		});

From 5dd211cc8845fd4533966bf8d7a7f2a6359ea013 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Thu, 1 Sep 2016 12:24:14 +0200
Subject: [PATCH 2/3] Also prevent null byte character

---
 apps/files/js/filelist.js           | 3 ++-
 apps/files/tests/js/filelistSpec.js | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js
index a61f6eaf89..bcf6f991c5 100644
--- a/apps/files/js/filelist.js
+++ b/apps/files/js/filelist.js
@@ -1339,7 +1339,8 @@
 				}
 			}
 
-			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1;
+			return path.toLowerCase().indexOf(decodeURI('%0a')) === -1 &&
+				path.toLowerCase().indexOf(decodeURI('%00')) === -1;
 		},
 
 		/**
diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js
index 9753e80d18..e23a42ec4e 100644
--- a/apps/files/tests/js/filelistSpec.js
+++ b/apps/files/tests/js/filelistSpec.js
@@ -1334,6 +1334,7 @@ describe('OCA.Files.FileList tests', function() {
 				'/abc/../',
 				'/../abc/',
 				'/foo%0Abar/',
+				'/foo%00bar/',
 				'/another\\subdir/../foo\\../bar\\..\\file/..\\folder/../'
 			], function(path) {
 				fileList.changeDirectory(decodeURI(path));

From 1352365e8bf5ea49da3dc82b1ccf7ddb659ae960 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Thu, 1 Sep 2016 10:17:15 +0200
Subject: [PATCH 3/3] Add PhantomJS to gitignore

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 0e9a5dd053..46e1174b79 100644
--- a/.gitignore
+++ b/.gitignore
@@ -104,6 +104,7 @@ nbproject
 /build/lib/
 /build/jsdocs/
 /npm-debug.log
+/PhantomJS_*
 
 # puphpet
 puphpet