Skip to content
Permalink
Browse files Browse the repository at this point in the history
Improved security.
  • Loading branch information
petersirka committed Feb 13, 2019
1 parent e2f3898 commit c37cafb
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 3 deletions.
15 changes: 13 additions & 2 deletions index.js
Expand Up @@ -68,7 +68,6 @@ const REG_ENCODINGCLEANER = /[;\s]charset=utf-8/g;
const REG_SKIPERROR = /epipe|invalid\sdistance/i;
const REG_OLDCONF = /-/g;
const REG_UTF8 = /[^\x20-\x7E]+/;
const REG_TRAVEL = /(\/)?\.\.\//g;
const FLAGS_INSTALL = ['get'];
const FLAGS_DOWNLOAD = ['get', 'dnscache'];
const QUERYPARSEROPTIONS = { maxKeys: 33 };
Expand Down Expand Up @@ -7327,7 +7326,19 @@ F.listener = function(req, res) {
var headers = req.headers;
req.$protocol = ((req.connection && req.connection.encrypted) || ((headers['x-forwarded-proto'] || ['x-forwarded-protocol']) === 'https')) ? 'https' : 'http';

req.url = req.url.replace(REG_TRAVEL, '');
var beg = 0;

// Removes directory browsing
for (var i = 0; i < req.url.length; i++) {
if (req.url[i] === '.' && req.url[i + 1] === '/')
beg = i + 1;
else if (req.url[i] === '?')
break;
}

if (beg)
req.url = req.url.substring(beg);

req.uri = framework_internal.parseURI(req);

F.stats.request.request++;
Expand Down
2 changes: 1 addition & 1 deletion package.json
Expand Up @@ -99,7 +99,7 @@
"name": "Sarp Aykent",
"email": "shackhers@gmail.com"
}],
"version": "3.2.0",
"version": "3.2.1",
"homepage": "http://www.totaljs.com",
"bugs": {
"url": "https://github.com/totaljs/framework/issues",
Expand Down

1 comment on commit c37cafb

@truedat101
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@petersirka does this issue affect earlier generation of Total.js, before 2.0?

Please sign in to comment.