Merge commit from fork

Fix for path traversal (GHSA-948g-2vm7-mfv7)
idurar · Oct 4, 2024 · 949bc6f · 949bc6f
2 parents 100525d + 5860bc5
commit 949bc6f
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/backend/src/routes/coreRoutes/corePublicRouter.js b/backend/src/routes/coreRoutes/corePublicRouter.js
@@ -8,9 +8,10 @@ const path = require('path');
 router.route('/:subPath/:directory/:file').get(function (req, res) {
   try {
     const { subPath, directory, file } = req.params;
-
+    //subPath sanitization check
+    sanitizedPath = path.normalize(subPath).replace(/^(\.\.[\/\\])+/, '');
     const options = {
-      root: path.join(__dirname, `../../public/${subPath}/${directory}`),
+      root: path.join(__dirname, `../../public/${sanitizedPath}/${directory}`),
     };
     const fileName = file;
     return res.sendFile(fileName, options, function (error) {