miel.truyen/nx
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

fix(core): make sanitizePath cross-platform (#6308)

Browse Source
This commit is contained in:
Daniel 2021-07-10 12:15:31 -06:00 committed by GitHub
parent 41234db93b
commit 8aee6cbc57
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
packages/workspace/src/command-line/dep-graph.ts
View File

@ -6,7 +6,7 @@ import { copySync, ensureDirSync } from 'fs-extra';
import * as http from 'http';
import ignore from 'ignore';
import * as open from 'open';
import { dirname, join, normalize, parse } from 'path';
import { dirname, join, parse, basename } from 'path';
import { performance } from 'perf_hooks';
import { URL } from 'url';
import { workspaceLayout } from '../core/file-utils';
@ -369,18 +369,16 @@ function startServer(
// Avoid https://en.wikipedia.org/wiki/Directory_traversal_attack
// e.g curl --path-as-is http://localhost:9000/../fileInDanger.txt
// by limiting the path to current directory only
const sanitizePath = normalize(parsedUrl.pathname).replace(
/^(\.\.[\/\\])+/,
''
);
if (sanitizePath === '/projectGraph.json') {
const sanitizePath = basename(parsedUrl.pathname);
if (sanitizePath === 'projectGraph.json') {
res.writeHead(200, { 'Content-Type': 'application/json' });
res.end(JSON.stringify(currentDepGraphClientResponse));
return;
}
if (sanitizePath === '/currentHash') {
if (sanitizePath === 'currentHash') {
res.writeHead(200, { 'Content-Type': 'application/json' });
res.end(JSON.stringify({ hash: currentDepGraphClientResponse.hash }));
return;