Close security vulnerability in generateRequestHandler()

If mounted without a path (eg `app.use(generateRequestHandler())`), this could reveal unsecured system files via an attack containing parent directories if the installation directory is not itself secuted.
MatAtBread · Mar 7, 2018 · bfcb809 · bfcb809
1 parent fff70ba
commit bfcb809
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 2 deletions.
diff --git a/nodent.js b/nodent.js
@@ -262,6 +262,9 @@ function generateRequestHandler(path, matchRegex, options) {
 	var compilerOptions = copyObj([NodentCompiler.initialCodeGenOpts,options.compiler]) ;
 
 	return function (req, res, next) {
+		if (req.url.indexOf('..')>=0)
+			return next() ;
+
 		if (cache[req.url]) {
 			res.setHeader("Content-Type", cache[req.url].contentType);
 			options.setHeaders && options.setHeaders(res) ;

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nodent",
-  "version": "3.1.6",
+  "version": "3.1.7",
   "description": "NoDent - Asynchronous Javascript language extensions",
   "main": "nodent.js",
   "scripts": {