From 94a195ba295d90f07039a3c9b4de20a379ee0b67 Mon Sep 17 00:00:00 2001
From: Jari Kolehmainen <jari.kolehmainen@gmail.com>
Date: Fri, 26 Mar 2021 13:27:32 +0200
Subject: [PATCH] fix path traversal bug in router

Signed-off-by: Jari Kolehmainen <jari.kolehmainen@gmail.com>
---
 src/main/router.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/main/router.ts b/src/main/router.ts
index bb49aacdab..3f53a78e72 100644
--- a/src/main/router.ts
+++ b/src/main/router.ts
@@ -40,10 +40,12 @@ export interface LensApiRequest<P = any> {
 
 export class Router {
   protected router: any;
+  protected staticRootPath: string;
 
   public constructor() {
     this.router = new Call.Router();
     this.addRoutes();
+    this.staticRootPath = path.resolve(__static);
   }
 
   public async route(cluster: Cluster, req: http.IncomingMessage, res: http.ServerResponse): Promise<boolean> {
@@ -102,7 +104,15 @@ export class Router {
   }
 
   async handleStaticFile(filePath: string, res: http.ServerResponse, req: http.IncomingMessage, retryCount = 0) {
-    const asset = path.join(__static, filePath);
+    const asset = path.join(this.staticRootPath, filePath);
+    const normalizedFilePath = path.resolve(asset);
+
+    if (!normalizedFilePath.startsWith(this.staticRootPath)) {
+      res.statusCode = 404;
+      res.end();
+
+      return;
+    }
 
     try {
       const filename = path.basename(req.url);