Sakurai/pdf.js
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #10304 from april/master

Browse Source 
Add protection against directory traversal attacks
This commit is contained in:
Tim van der Meij 2018-12-10 23:18:30 +01:00 committed by GitHub
commit 2f4c7e01f5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
test/webserver.js
View File

@ -80,7 +80,11 @@ WebServer.prototype = {
_handler: function (req, res) {
var url = req.url.replace(/\/\//g, '/');
var urlParts = /([^?]*)((?:\?(.*))?)/.exec(url);
var pathPart = decodeURI(urlParts[1]), queryPart = urlParts[3];
// guard against directory traversal attacks,
// e.g. /../../../../../../../etc/passwd
// which let you make GET requests for files outside of this.root
var pathPart = path.normalize(decodeURI(urlParts[1]));
var queryPart = urlParts[3];
var verbose = this.verbose;
var methodHooks = this.hooks[req.method];