Mirrors/cloudcmd
1
0
Fork 0
mirror of https://github.com/coderaiser/cloudcmd.git synced 2026-01-23 02:35:49 +00:00
Code Issues Projects Releases Wiki Activity

fix: server: route: path traversal

Browse source
This commit is contained in:
coderaiser 2024-04-16 23:04:46 +03:00
parent 37ab7068d9
commit 6fb2102099
2 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
server/route.mjs
View file

@ -77,7 +77,11 @@ async function route({config, options, request, response}) {
const rootName = name.replace(CloudFunc.FS, '') || '/';
const fullPath = root(rootName, config('root'));
if (fullPath.indexOf(config('root')))
return ponse.sendError(Error(`Path '${fullPath}' beyond root '${config('root')}'`), p);
const {html, win32} = options;
const read = getReadDir(config, {
win32,
});