Skip to content

Commit

Permalink
Fix root path disclosure
Browse files Browse the repository at this point in the history
fixes #70
  • Loading branch information
dougwilson committed Jan 20, 2015
1 parent 408cba6 commit 98a5b89
Show file tree
Hide file tree
Showing 3 changed files with 21 additions and 5 deletions.
5 changes: 5 additions & 0 deletions History.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
unreleased
==========

* Fix `root` path disclosure

0.11.0 / 2015-01-05
===================

Expand Down
10 changes: 5 additions & 5 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -415,16 +415,16 @@ SendStream.prototype.pipe = function(res){

var parts
if (root !== null) {
// join / normalize from optional root dir
path = normalize(join(root, path))
root = normalize(root + sep)

// malicious path
if ((path + sep).substr(0, root.length) !== root) {
if (upPathRegexp.test(normalize('.' + sep + path))) {
debug('malicious path "%s"', path)
return this.error(403)
}

// join / normalize from optional root dir
path = normalize(join(root, path))
root = normalize(root + sep)

// explode path parts
parts = path.substr(root.length).split(sep)
} else {
Expand Down
11 changes: 11 additions & 0 deletions test/send.js
Original file line number Diff line number Diff line change
Expand Up @@ -1170,6 +1170,17 @@ describe('send(file, options)', function(){
.get('/../name.dir/name.txt')
.expect(403, done)
})

it('should not allow root path disclosure', function(done){
var app = http.createServer(function(req, res){
send(req, req.url, {root: __dirname + '/fixtures'})
.pipe(res);
});

request(app)
.get('/pets/../../fixtures/name.txt')
.expect(403, done)
})
})

describe('when missing', function(){
Expand Down

0 comments on commit 98a5b89

Please sign in to comment.