hendrik/lens
1
0
Fork 0
mirror of https://github.com/lensapp/lens.git synced 2025-05-20 05:10:56 +00:00
Code Issues Projects Releases Wiki Activity

fix path traversal bug in router

Browse Source 
Signed-off-by: Jari Kolehmainen <jari.kolehmainen@gmail.com>
This commit is contained in:
Jari Kolehmainen 2021-03-26 13:27:32 +02:00
parent 0765bcee9c
commit 94a195ba29
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/main/router.ts
View File

@ -40,10 +40,12 @@ export interface LensApiRequest<P = any> {
export class Router { export class Router {
protected router: any; protected router: any;
protected staticRootPath: string;
public constructor() { public constructor() {
this.router = new Call.Router(); this.router = new Call.Router();
this.addRoutes(); this.addRoutes();
this.staticRootPath = path.resolve(__static);
} }
public async route(cluster: Cluster, req: http.IncomingMessage, res: http.ServerResponse): Promise<boolean> { public async route(cluster: Cluster, req: http.IncomingMessage, res: http.ServerResponse): Promise<boolean> {
@ -102,7 +104,15 @@ export class Router {
} }
async handleStaticFile(filePath: string, res: http.ServerResponse, req: http.IncomingMessage, retryCount = 0) { async handleStaticFile(filePath: string, res: http.ServerResponse, req: http.IncomingMessage, retryCount = 0) {
const asset = path.join(__static, filePath); const asset = path.join(this.staticRootPath, filePath);
const normalizedFilePath = path.resolve(asset);
if (!normalizedFilePath.startsWith(this.staticRootPath)) {
res.statusCode = 404;
res.end();
return;
}
try { try {
const filename = path.basename(req.url); const filename = path.basename(req.url);