From 3ebb19d8a2964abe4c21700a4208b1a66f39eb85 Mon Sep 17 00:00:00 2001 From: Tom Hunkapiller Date: Fri, 10 Apr 2015 19:25:52 -0500 Subject: [PATCH 1/2] fix an issue in the path handling that allowed directory traversal --- src/node/hooks/express/tests.js | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/node/hooks/express/tests.js b/src/node/hooks/express/tests.js index fcd813817..f3d721a94 100644 --- a/src/node/hooks/express/tests.js +++ b/src/node/hooks/express/tests.js @@ -23,6 +23,7 @@ exports.expressCreateServer = function (hook_name, args, cb) { }); + var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/"); var url2FilePath = function(url){ var subPath = url.substr("/tests/frontend".length); if (subPath == ""){ @@ -30,8 +31,11 @@ exports.expressCreateServer = function (hook_name, args, cb) { } subPath = subPath.split("?")[0]; - var filePath = path.normalize(npm.root + "/../tests/frontend/") - filePath += subPath.replace("..", ""); + var filePath = path.normalize(path.join(rootTestFolder, subPath)); + // make sure we jail the paths to the test folder, otherwise serve index + if (filePath.indexOf(rootTestFolder) !== 0) { + filePath = path.normalize(path.join(rootTestFolder, "index.html")); + } return filePath; } From 2e4374c08ddbc0753a486f23b45df65f0cbd7eb5 Mon Sep 17 00:00:00 2001 From: Tom Hunkapiller Date: Fri, 10 Apr 2015 20:19:26 -0500 Subject: [PATCH 2/2] clearer comments about the path handling behavior --- src/node/hooks/express/tests.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/node/hooks/express/tests.js b/src/node/hooks/express/tests.js index f3d721a94..d0dcc0cc6 100644 --- a/src/node/hooks/express/tests.js +++ b/src/node/hooks/express/tests.js @@ -23,7 +23,10 @@ exports.expressCreateServer = function (hook_name, args, cb) { }); - var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/"); + + // path.join seems to normalize by default, but we'll just be explicit + var rootTestFolder = path.normalize(path.join(npm.root, "../tests/frontend/")); + var url2FilePath = function(url){ var subPath = url.substr("/tests/frontend".length); if (subPath == ""){ @@ -34,7 +37,7 @@ exports.expressCreateServer = function (hook_name, args, cb) { var filePath = path.normalize(path.join(rootTestFolder, subPath)); // make sure we jail the paths to the test folder, otherwise serve index if (filePath.indexOf(rootTestFolder) !== 0) { - filePath = path.normalize(path.join(rootTestFolder, "index.html")); + filePath = path.join(rootTestFolder, "index.html"); } return filePath; }