Merge pull request from GHSA-j2wh-wrv3-4x4g

ardatan · Feb 16, 2023 · 95d93e7 · 95d93e7
1 parent 5c19f8d
commit 95d93e7
Show file tree

Hide file tree

Showing 6 changed files with 55 additions and 2 deletions.
diff --git a/.changeset/dry-countries-travel.md b/.changeset/dry-countries-travel.md
@@ -0,0 +1,5 @@
+---
+'@graphql-mesh/http': patch
+---
+
+When `staticFiles` is set, do not allow to access upper directories
diff --git a/packages/http/src/index.ts b/packages/http/src/index.ts
@@ -86,8 +86,9 @@ export function createMeshHTTPHandler<TServerContext>({
       if (!relativePath) {
         relativePath = 'index.html';
       }
-      const absolutePath = path.join(baseDir, staticFiles, relativePath);
-      if (await pathExists(absolutePath)) {
+      const absoluteStaticFilesPath = path.join(baseDir, staticFiles);
+      const absolutePath = path.join(absoluteStaticFilesPath, relativePath);
+      if (absolutePath.startsWith(absoluteStaticFilesPath) && (await pathExists(absolutePath))) {
         const readStream = fs.createReadStream(absolutePath);
         return new Response(readStream as any, {
           status: 200,

diff --git a/packages/http/test/fixtures/static-files/index.html b/packages/http/test/fixtures/static-files/index.html
@@ -0,0 +1,12 @@
+<html>
+  <head>
+    <title>Static Files</title>
+    <link rel="stylesheet" href="style.css" />
+    <script src="script.js"></script>
+  </head>
+  <body>
+    <h1>Static Files</h1>
+    <p>Some static files.</p>
+    <p id="test"></p>
+  </body>
+</html>
diff --git a/packages/http/test/fixtures/static-files/script.js b/packages/http/test/fixtures/static-files/script.js
@@ -0,0 +1 @@
+document.getElementById('test').innerHTML = 'Hello World!';
diff --git a/packages/http/test/fixtures/static-files/style.css b/packages/http/test/fixtures/static-files/style.css
@@ -0,0 +1,8 @@
+body {
+  background: #fff;
+  color: #000;
+  font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;
+  font-size: 14px;
+  line-height: 1.42857143;
+  margin: 0;
+}
diff --git a/packages/http/test/http.spec.ts b/packages/http/test/http.spec.ts
@@ -0,0 +1,26 @@
+import { createMeshHTTPHandler } from '@graphql-mesh/http';
+import { MeshInstance } from '@graphql-mesh/runtime';
+import { getTestMesh } from '../../testing/getTestMesh';
+
+describe('http', () => {
+  let mesh: MeshInstance;
+  beforeEach(async () => {
+    mesh = await getTestMesh();
+  });
+  it('should not allow upper directory access when `staticFiles` is set', async () => {
+    const httpHandler = createMeshHTTPHandler({
+      baseDir: __dirname,
+      getBuiltMesh: async () => mesh,
+      rawServeConfig: {
+        staticFiles: './fixtures/static-files',
+      },
+    });
+    const response = await httpHandler.fetch(
+      'http://localhost:4000/..%2f/..%2f/..%2f/package.json',
+    );
+    expect(response.status).toBe(404);
+  });
+  afterEach(() => {
+    mesh.destroy();
+  });
+});