Skip to content
Permalink
Browse files Browse the repository at this point in the history
fix: translator path traversal
  • Loading branch information
barisusakli committed Oct 25, 2021
1 parent 835c73c commit c8b2fc4
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 2 deletions.
6 changes: 5 additions & 1 deletion src/languages.js
Expand Up @@ -13,7 +13,11 @@ const files = fs.readdirSync(path.join(paths.nodeModules, '/timeago/locales'));
Languages.timeagoCodes = files.filter(f => f.startsWith('jquery.timeago')).map(f => f.split('.')[2]);

Languages.get = async function (language, namespace) {
const data = await fs.promises.readFile(path.join(languagesPath, language, `${namespace}.json`), 'utf8');
const pathToLanguageFile = path.join(languagesPath, language, `${namespace}.json`);
if (!pathToLanguageFile.startsWith(languagesPath)) {
throw new Error('[[error:invalid-path]]');
}
const data = await fs.promises.readFile(pathToLanguageFile, 'utf8');
const parsed = JSON.parse(data) || {};
const result = await plugins.hooks.fire('filter:languages.get', {
language,
Expand Down
2 changes: 1 addition & 1 deletion test/posts.js
@@ -1,7 +1,7 @@
'use strict';


const assert = require('assert');
const assert = require('assert');
const async = require('async');
const request = require('request');
const nconf = require('nconf');
Expand Down
5 changes: 5 additions & 0 deletions test/translator.js
Expand Up @@ -35,6 +35,11 @@ describe('Translator shim', () => {
const translated = await shim.translate('', 'en-GB');
assert.strictEqual(translated, '');
});

it('should not allow path traversal', async () => {
const t = await shim.translate('[[../../../../config:secret]]');
assert.strictEqual(t, 'secret');
});
});
});

Expand Down

0 comments on commit c8b2fc4

Please sign in to comment.