CalvinBackup/anonymous_github
1
0
Fork 0
mirror of https://github.com/tdurieux/anonymous_github.git synced 2026-09-12 21:58:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: decode and validate webview file paths

Browse Source
This commit is contained in:
tdurieux
2026-09-06 09:17:56 +02:00
parent 67eb83674c
commit 9c18526d52
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/routes/webview.ts
+8 -2
View File
@@ -83,13 +83,19 @@ async function webView(req: express.Request, res: express.Response) {
const wRoot = repo.options.pageSource.path;
const indexRepoId = req.path.indexOf(req.params.repoId);
const filePath = req.path.substring(
const rawPath = req.path.substring(
indexRepoId + req.params.repoId.length + 1
);
let filePath: string;
try {
filePath = decodeURIComponent(rawPath);
} catch {
throw new AnonymousError("invalid_path", { httpStatus: 400 });
}
// Reject traversal in the URL-derived segment before joining it onto the
// page-source root. Stripping a single leading "/" or "." is not enough
// to stop "../../" sequences from climbing out of the repo (CWE-22).
if (filePath.split(/[\\/]/).some((segment) => segment === "..")) {
if (/^[\\/]/.test(filePath) || filePath.split(/[\\/]/).some((segment) => segment === "..")) {
throw new AnonymousError("invalid_path", {
httpStatus: 400,
object: filePath,