Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix serve.js module, prevent access to files in parent directories. #527

Merged
merged 2 commits into from Apr 17, 2019

Conversation

@JK0N
Copy link
Contributor

JK0N commented Apr 10, 2018

…t's a bad idea to have your code serve your source code but if it needs to be done, this will prevent the most obvious leaks (curl -v --path-as-is 'http://localhost:8080/gun/../../.env')

…t's a bad idea to have your code serve your source code but if it needs to be done, this will prevent the most obvious leaks (curl -v --path-as-is 'http://localhost:8080/gun/../../.env')
@amark

This comment has been minimized.

Copy link
Owner

amark commented Apr 10, 2018

@JK0N I had Travis re-run the test, there is a performance test that has a very small "acceptable" range that failed (I need to increase the range so it is more flexible on Travis), your code looks like the tests are passing. Will try to get this merged soon (swamped this week), hopefully later today but might not be till next week (with Martti being in town).

@amark

This comment has been minimized.

Copy link
Owner

amark commented May 16, 2018

@JK0N thanks for this... still need to process it, sorry!

@amark

This comment has been minimized.

Copy link
Owner

amark commented Apr 17, 2019

@JK0N dude I'm so sorry this took forever... this was a REALLY IMPORTANT update and I was so swamped & stressed last year I had like 0 money and was super depressed and trying to make ends meet. And this happened just as I was recovering, then I totally forgot about it.

THANK YOU SO MUCH, merging now. I have a couple other important updates to it that I have locally, so after I merge and then patch it'll look quite a bit different from your original commit, but it is based off your same design and guarantees things won't leak, I use your same curl command to check/verify/test.

@amark amark merged commit 8bc815e into amark:master Apr 17, 2019
1 check was pending
1 check was pending
continuous-integration/travis-ci/pr The Travis CI build is in progress
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants
You can’t perform that action at this time.