DorianNiemiecSVRJS/svrjs
Archived
1
0
Fork 0
forked from svrjs/svrjs
Code Pull requests Activity

Fix the forbidden path checking function, and add test cases, where it would fail before the fix

Browse source
This commit is contained in:
Dorian Niemiec 2024-08-29 19:37:03 +02:00
parent 9f51366515
commit 41901d9a27
2 changed files with 18 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/utils/forbiddenPaths.js
View file

@ -54,16 +54,23 @@ function isIndexOfForbiddenPath(decodedHref, match) {
if (typeof forbiddenPath === "string") {
const forbiddenPathLower = isWin32 ? forbiddenPath.toLowerCase() : null;
return isWin32
? decodedHrefLower.indexOf(forbiddenPathLower) == 0
: decodedHref.indexOf(forbiddenPath) == 0;
? decodedHrefLower === forbiddenPathLower ||
decodedHrefLower.indexOf(forbiddenPathLower + "/") == 0
: decodedHref === forbiddenPath ||
decodedHref.indexOf(forbiddenPath + "/") == 0;
}
if (typeof forbiddenPath === "object") {
return isWin32
? forbiddenPath.some(
(path) => decodedHrefLower.indexOf(path.toLowerCase()) == 0,
(path) =>
decodedHrefLower === path.toLowerCase() ||
decodedHrefLower.indexOf(path.toLowerCase() + "/") == 0,
)
: forbiddenPath.some((path) => decodedHref.indexOf(path) == 0);
: forbiddenPath.some(
(path) =>
decodedHref === path || decodedHref.indexOf(path + "/") == 0,
);
}
return false;

7
tests/utils/forbiddenPaths.test.js
View file

@ -117,6 +117,13 @@ describe("Forbidden paths handling", () => {
expect(
isIndexOfForbiddenPath("/notforbidden/", "serverSideScriptDirectories"),
).toBe(false);
expect(isIndexOfForbiddenPath("/config.json.fake", "config")).toBe(false);
expect(
isIndexOfForbiddenPath(
"/node_modules_fake/",
"serverSideScriptDirectories",
),
).toBe(false);
});
test("should handle case insensitivity on Windows", () => {