FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Don't let path.normalize get above the root. · nickstenning/node@65037ee · GitHub

Repository navigation

Commit 65037ee

Browse files
authored andcommitted
Don't let path.normalize get above the root.
Any path.join or path.normalize that starts with a / will not go "above" that after normalization. This is important because /../foo is almost *always* some sort of error, and doesn't match the corollary in sh: `cd $p; pwd` At the worse, this can be a vector for exploits, since a static file server might do path.join(docroot, path.normalize("/"+req)) to get the file. If the normalized request path could be something like "/../../../etc/passwd" then bad things could happen.
1 parent dc8c079 commit 65037ee

2 files changed

Lines changed: 6 additions & 0 deletions

File tree

‎lib/path.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ exports.normalizeArray = function (parts, keepBlanks) {
1414
// if it's a dot, and there was some previous dir already, then skip it.
1515
if (directory === "." && prev !== undefined) continue;
1616

17+
// if it starts with "", and is a . or .., then skip it.
18+
if (directories.length === 1 && directories[0] === "" && (
19+
directory === "." || directory === "..")) continue;
20+
1721
if (
1822
directory === ".."
1923
&& directories.length

‎test/simple/test-path.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,11 @@ assert.equal(path.extname("file.ext.ext"), ".ext");
3838
assert.equal(path.extname("file."), ".");
3939

4040
assert.equal(path.join(".", "fixtures/b", "..", "/b/c.js"), "fixtures/b/c.js");
41+
assert.equal(path.join("/foo", "../../../bar"), "/bar");
4142

4243
assert.equal(path.normalize("./fixtures///b/../b/c.js"), "fixtures/b/c.js");
4344
assert.equal(path.normalize("./fixtures///b/../b/c.js",true), "fixtures///b/c.js");
45+
assert.equal(path.normalize("/foo/../../../bar"), "/bar");
4446

4547
assert.deepEqual(path.normalizeArray(["fixtures","b","","..","b","c.js"]), ["fixtures","b","c.js"]);
4648
assert.deepEqual(path.normalizeArray(["fixtures","","b","..","b","c.js"], true), ["fixtures","","b","c.js"]);

0 commit comments

Comments
 (0)

Back | FazBrowse Home | New Git URL