DorianNiemiecSVRJS/svrjs
Archived
1
0
Fork 0
forked from svrjs/svrjs
Code Pull requests Activity

Fix the forbidden path checking function, and add test cases, where it would fail before the fix

Browse source
This commit is contained in:
Dorian Niemiec 2024-08-29 19:37:03 +02:00
parent 9f51366515
commit 41901d9a27
2 changed files with 18 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/utils/forbiddenPaths.js
View file

@ -54,16 +54,23 @@ function isIndexOfForbiddenPath(decodedHref, match) {
if (typeof forbiddenPath === "string") { if (typeof forbiddenPath === "string") {
const forbiddenPathLower = isWin32 ? forbiddenPath.toLowerCase() : null; const forbiddenPathLower = isWin32 ? forbiddenPath.toLowerCase() : null;
return isWin32 return isWin32
? decodedHrefLower.indexOf(forbiddenPathLower) == 0 ? decodedHrefLower === forbiddenPathLower ||
: decodedHref.indexOf(forbiddenPath) == 0; decodedHrefLower.indexOf(forbiddenPathLower + "/") == 0
: decodedHref === forbiddenPath ||
decodedHref.indexOf(forbiddenPath + "/") == 0;
} }
if (typeof forbiddenPath === "object") { if (typeof forbiddenPath === "object") {
return isWin32 return isWin32
? forbiddenPath.some( ? forbiddenPath.some(
(path) => decodedHrefLower.indexOf(path.toLowerCase()) == 0, (path) =>
decodedHrefLower === path.toLowerCase() ||
decodedHrefLower.indexOf(path.toLowerCase() + "/") == 0,
) )
: forbiddenPath.some((path) => decodedHref.indexOf(path) == 0); : forbiddenPath.some(
(path) =>
decodedHref === path || decodedHref.indexOf(path + "/") == 0,
);
} }
return false; return false;

7
tests/utils/forbiddenPaths.test.js
View file

@ -117,6 +117,13 @@ describe("Forbidden paths handling", () => {
expect( expect(
isIndexOfForbiddenPath("/notforbidden/", "serverSideScriptDirectories"), isIndexOfForbiddenPath("/notforbidden/", "serverSideScriptDirectories"),
).toBe(false); ).toBe(false);
expect(isIndexOfForbiddenPath("/config.json.fake", "config")).toBe(false);
expect(
isIndexOfForbiddenPath(
"/node_modules_fake/",
"serverSideScriptDirectories",
),
).toBe(false);
}); });
test("should handle case insensitivity on Windows", () => { test("should handle case insensitivity on Windows", () => {