specter/CyTube
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #223 from gro-ove/master

Browse source 
Fixed: path traversal attack
This commit is contained in:
Calvin Montgomery 2013-07-19 14:33:37 -07:00
parent 383525fd9f deb0231b7f
commit a25b2fdadf
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
server.js
View file

@ -1,3 +1,4 @@
var path = require("path");
var express = require("express"); var express = require("express");
var Config = require("./config"); var Config = require("./config");
var Logger = require("./logger"); var Logger = require("./logger");
@ -89,6 +90,11 @@ var Server = {
// default path // default path
this.app.get("/:thing(*)", function (req, res, next) { this.app.get("/:thing(*)", function (req, res, next) {
var root = __dirname + "/www/",
answer = path.resolve (__dirname + "/www/", req.params.thing);
if (answer.indexOf (root) != 0)
res.send (404);
else
res.sendfile(__dirname + "/www/" + req.params.thing); res.sendfile(__dirname + "/www/" + req.params.thing);
}); });