diff --git a/lib/node-router.js b/lib/node-router.js index 74c91b4..975e751 100644 --- a/lib/node-router.js +++ b/lib/node-router.js @@ -311,7 +311,7 @@ exports.staticDirHandler = function(root, prefix) { var filename = req.url.replace(/[\?|#].*$/, ''); if (prefix) filename = filename.replace(new RegExp('^'+prefix), ''); // make sure nobody can explore our local filesystem - filename = path.join(root, filename.replace(/\.\./g, '.')); + filename = path.join(root, filename.replace(/\.\.+/g, '.')); if (filename == root) filename = path.join(root, 'index.html'); loadResponseData(req, res, filename, function(headers, body, encoding) { res.writeHead(200, headers);