OSSForks/express
1
0
Fork 0
mirror of https://github.com/zebrajr/express.git synced 2025-12-06 00:19:48 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

examples: fix path traversal in downloads example

Browse Source 
closes #4120
This commit is contained in:
KoyamaSohei 2019-12-13 14:38:56 +09:00 committed by Douglas Christopher Wilson
parent 12310c5294
commit 82de4de5ab
3 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
examples/downloads/index.js
View File

@ -6,8 +6,13 @@
var express = require('../../'); var express = require('../../');
var path = require('path'); var path = require('path');
var resolvePath = require('resolve-path')
var app = module.exports = express(); var app = module.exports = express();
// path to where the files are stored on disk
var FILES_DIR = path.join(__dirname, 'files')
app.get('/', function(req, res){ app.get('/', function(req, res){
res.send('<ul>' + res.send('<ul>' +
'<li>Download <a href="/files/notes/groceries.txt">notes/groceries.txt</a>.</li>' + '<li>Download <a href="/files/notes/groceries.txt">notes/groceries.txt</a>.</li>' +
@ -20,7 +25,7 @@ app.get('/', function(req, res){
// /files/* is accessed via req.params[0] // /files/* is accessed via req.params[0]
// but here we name it :file // but here we name it :file
app.get('/files/:file(*)', function(req, res, next){ app.get('/files/:file(*)', function(req, res, next){
var filePath = path.join(__dirname, 'files', req.params.file); var filePath = resolvePath(FILES_DIR, req.params.file)
res.download(filePath, function (err) { res.download(filePath, function (err) {
if (!err) return; // file sent if (!err) return; // file sent

1
package.json
View File

@ -75,6 +75,7 @@
"multiparty": "4.2.2", "multiparty": "4.2.2",
"nyc": "15.1.0", "nyc": "15.1.0",
"pbkdf2-password": "1.2.1", "pbkdf2-password": "1.2.1",
"resolve-path": "1.4.0",
"should": "13.2.3", "should": "13.2.3",
"supertest": "6.2.2", "supertest": "6.2.2",
"vhost": "~3.0.2" "vhost": "~3.0.2"

8
test/acceptance/downloads.js
View File

@ -36,4 +36,12 @@ describe('downloads', function(){
.expect(404, done) .expect(404, done)
}) })
}) })
describe('GET /files/../index.js', function () {
it('should respond with 403', function (done) {
request(app)
.get('/files/../index.js')
.expect(403, done)
})
})
}) })