From 3ebb19d8a2964abe4c21700a4208b1a66f39eb85 Mon Sep 17 00:00:00 2001
From: Tom Hunkapiller <tom@furycodes.com>
Date: Fri, 10 Apr 2015 19:25:52 -0500
Subject: [PATCH] fix an issue in the path handling that allowed directory
 traversal

---
 src/node/hooks/express/tests.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/node/hooks/express/tests.js b/src/node/hooks/express/tests.js
index fcd813817..f3d721a94 100644
--- a/src/node/hooks/express/tests.js
+++ b/src/node/hooks/express/tests.js
@@ -23,6 +23,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
 
   });
 
+  var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/");
   var url2FilePath = function(url){
     var subPath = url.substr("/tests/frontend".length);
     if (subPath == ""){
@@ -30,8 +31,11 @@ exports.expressCreateServer = function (hook_name, args, cb) {
     }
     subPath = subPath.split("?")[0];
 
-    var filePath = path.normalize(npm.root + "/../tests/frontend/")
-    filePath += subPath.replace("..", "");
+    var filePath = path.normalize(path.join(rootTestFolder, subPath));
+    // make sure we jail the paths to the test folder, otherwise serve index
+    if (filePath.indexOf(rootTestFolder) !== 0) {
+      filePath = path.normalize(path.join(rootTestFolder, "index.html"));
+    }
     return filePath;
   }