5 ms·

Thanks for pointing this out. Fixed this particular bug!

• q3k 8y ago
  You also need to report this to security@npmjs.com so they post an advisory [1] and mark the existing versions as vulnerable. [1] - https://www.npmjs.com/advisories https://www.npmjs.com/advisories
  • Sephr 8y ago
    Anyone, including yourself can do that.
    • cat199 8y ago
      or, the person who should do it should do it and not rely on others to do their job for them?
      • danr4 8y ago
        it's not their job. there's a reason anyone can do it.
    • rarecoil 8y ago
      Everyone's talking about it but nobody did it, so I did.
• wesleytodd 8y ago
  Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, the url package method you are using is deprecated[2]. [1] https://github.com/remoteinterview/zero/commit/b4af5325c388e21a9bba4c9305c9a61693c73578 https://github.com/remoteinterview/zero/commit/b4af5325c388e... [2] https://nodejs.org/api/url.html#url_legacy_url_api https://nodejs.org/api/url.html#url_legacy_url_api
  • hombre_fatal 8y ago
    A simpler fix might be to canonicalize (i.e. no "..") the public folder path and the requested file path and then ensure the public path is a prefix of the other.
    • Kalium 8y ago
      Any fix also needs to be sure to resolve any symlinks before doing a prefix check.
  • the_mitsuhiko 8y ago
    This fix does not even work on windows. You can still request data on a different drive.