From d755925f749b88157e0935a7fa3c3ed94480292e Mon Sep 17 00:00:00 2001 From: Johannes Zellner Date: Tue, 1 Mar 2016 12:42:13 +0100 Subject: Properly check for absolute file paths --- src/files.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/files.js b/src/files.js index d12782d..c2a4e0f 100644 --- a/src/files.js +++ b/src/files.js @@ -106,7 +106,9 @@ function del(req, res, next) { var filePath = req.params[0]; var absoluteFilePath = getAbsolutePath(filePath); if (!absoluteFilePath) return next(new HttpError(404, 'Not found')); - if (absoluteFilePath.slice(gBasePath.length) === '') return next(new HttpError(403, 'Forbidden')); + + // absoltueFilePath has to have the base path prepended + if (absoluteFilePath.length <= gBasePath.length) return next(new HttpError(403, 'Forbidden')); fs.stat(absoluteFilePath, function (error, result) { if (error) return next(new HttpError(404, error)); -- cgit v1.2.3