lukechilds/node - node - Gitea: Git with a cup of tea

Tree: 65037eeb32

isaacs 65037eeb32 Don't let path.normalize get above the root. Any path.join or path.normalize that starts with a / will not go "above" that after normalization. This is important because /../foo is almost always some sort of error, and doesn't match the corollary in sh: `cd $p; pwd` At the worse, this can be a vector for exploits, since a static file server might do path.join(docroot, path.normalize("/"+req)) to get the file. If the normalized request path could be something like "/../../../etc/passwd" then bad things could happen.		15 years ago
..
disabled	Update tests to work with module contexts	15 years ago
fixtures	Support including modules that don't have an extension.	15 years ago
internet	Split tests.	15 years ago
message	Update tests to work with module contexts	15 years ago
pummel	Update tests to work with module contexts	15 years ago
simple	Don't let path.normalize get above the root.	15 years ago
common.js	Update tests to work with module contexts	15 years ago