Merge pull request #659 from 418sec/master

harp - Unauthorized File Access - Fix:

lib/middleware.js

@@ -608,6 +608,22 @@ exports.process = function(req, rsp, next){
     /**
      * Now we let terraform handle the asset pipeline.
      */
+
+    // checking if the source file being served is a symlink
+    fs.lstat(sourceFile, function(err, stats) {
+      if (stats.isSymbolicLink()) {
+        fs.readlink(sourceFile, function (err, symlinkTo) {
+          // forbidding access if the symlink points to a file outside of the project's base directory to prevent path traversal
+          var projectPath = path.dirname(require.main.filename) // full path of the project's main file
+          var symlinkPath = path.dirname(symlinkTo)             // full path of the symlink
+          if (projectPath !== symlinkPath) {
+            var body = "403 Forbidden"
+            rsp.statusCode = 403
+            rsp.end(body)
+          }
+        });
+      }
+    });    
 
     req.poly.render(sourceFile, function(error, body){
       if(error){