refactor: normalize Draw asset paths - #147
Conversation
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: a164a0b9f9
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
|
||
| function resolveAssetPath(rootDir: string, requestPath: string): string { | ||
| const decodedPath = decodeURIComponent(requestPath); | ||
| return path.resolve(rootDir, `.${decodedPath}`); |
There was a problem hiding this comment.
When the Draw plugin is installed and a running session is reachable—new sessions start a detected tunnel by default—an unauthenticated requester or invited collaborator can send /..%2f..%2f<file>. Decoding converts the encoded separators into traversal segments, and path.resolve escapes ui/dist without a subsequent containment check. The static handler then streams any selected process-readable file, potentially exposing Crabcode configuration and credentials. Canonicalize the target and reject any path.relative(uiDistDir, target) result outside the asset root before filesystem access.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
npm --prefix plugins/draw run build:server