From 292cf7c649c4fa6cc63ed6a1ae9368d1dc70588d Mon Sep 17 00:00:00 2001
From: Martin Holst Swende <martin@swende.se>
Date: Fri, 30 Aug 2019 10:39:29 +0200
Subject: [PATCH] eth: disallow overwrite files via admin.exportChain

---
 eth/api.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/eth/api.go b/eth/api.go
index 98c2f5874..f8c51c09b 100644
--- a/eth/api.go
+++ b/eth/api.go
@@ -168,6 +168,11 @@ func NewPrivateAdminAPI(eth *Ethereum) *PrivateAdminAPI {
 
 // ExportChain exports the current blockchain into a local file.
 func (api *PrivateAdminAPI) ExportChain(file string) (bool, error) {
+	if _, err := os.Stat(file); err == nil {
+		// File already exists. Allowing overwrite could be a DoS vecotor,
+		// since the 'file' may point to arbitrary paths on the drive
+		return false, errors.New("location would overwrite an existing file")
+	}
 	// Make sure we can create the file to export into
 	out, err := os.OpenFile(file, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.ModePerm)
 	if err != nil {