Mirrors/cloudcmd
1
0
Fork 0
mirror of https://github.com/coderaiser/cloudcmd.git synced 2026-01-23 10:45:47 +00:00
Code Issues Projects Releases Wiki Activity

fix: server: route: path traversal

Browse source
This commit is contained in:
coderaiser 2024-04-16 23:04:46 +03:00
parent 37ab7068d9
commit 6fb2102099
2 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
server/route.mjs
View file

@ -77,7 +77,11 @@ async function route({config, options, request, response}) {
const rootName = name.replace(CloudFunc.FS, '') || '/';
const fullPath = root(rootName, config('root'));
if (fullPath.indexOf(config('root')))
return ponse.sendError(Error(`Path '${fullPath}' beyond root '${config('root')}'`), p);
const {html, win32} = options;
const read = getReadDir(config, {
win32,
});

7
test/rest/fs.mjs
View file

@ -18,3 +18,10 @@ test('cloudcmd: rest: fs: path', async (t) => {
t.equal(path, '/', 'should dir path be "/"');
t.end();
});
test('cloudcmd: path traversal beyond root', async (t) => {
const {body} = await request.get('/fs..%2f..%2fetc/passwd');
t.match(body, 'beyond root', 'should return beyond root message');
t.end();
});