Directory Traversal

[JacksonGL]

First of all, this is an awesome package with lots of functionalities.

It just has a directory traversal issue, which can be fixed by adding some filtering on the requested url path. To exploit the vulnerability, I can just send a web request say: http://localhost:80/../../../ to browse and retrieve any file on the hosting server.

Notice: the above url does not work with wget or a browser. Try it by using http.get in a Node.js program.

[shy2850]

Thank you for so much concern. that will be fixed within a week. u can also pull request to me

[JacksonGL]

I have created a pull request. Since I did not find test scripts, hopefully it will not break any existing functionality.

[JacksonGL]

Cool! Thanks for merging the pull request and patching the package on npm.
Just a friendly reminder: the following packages may need to be patched as well since their source code points to this repo:

• http-f2e-server
• xhserver
• f2e-node-server

[shy2850]

those packages have been all deprecated,