fix: Prevent directory traversal attack in dev mode (#63)

* Prevent directory traversal attack in dev mode

* Use resolve instead of normalize

Co-authored-by: Luke Edwards <luke.edwards05@gmail.com>

* Use startsWith instead of manually checking the substring

Co-authored-by: Luke Edwards <luke.edwards05@gmail.com>

* Inline test helper function

* Rewrite async/await to Promises for Node 6 on CI

* revert: use join + normalize again

Co-authored-by: Luke Edwards <luke.edwards05@gmail.com>

Author: marvinhagemeister

packages/sirv/index.js

@@ -1,5 +1,5 @@
 const fs = require('fs');
-const { join, resolve } = require('path');
+const { join, normalize, resolve } = require('path');
 const parser = require('@polka/url');
 const mime = require('mime/lite');
 
@@ -79,7 +79,10 @@ module.exports = function (dir, opts={}) {
 	if (opts.dev) {
 		return function (req, res, next) {
 			let stats, file, uri=decodeURIComponent(req.path || req.pathname || parser(req).pathname);
-			let arr = [uri].concat(toAssume(uri, extensions)).map(x => join(dir, x)).filter(fs.existsSync);
+			let arr = [uri].concat(toAssume(uri, extensions)).map(x => normalize(join(dir, x))).filter(x => {
+				return x.startsWith(dir) && fs.existsSync(x);
+			});
+
 			while (file = arr.shift()) {
 				stats = fs.statSync(file);
 				if (stats.isDirectory()) continue;

tests/sirv.js

@@ -1,7 +1,72 @@
 const test = require('tape');
 const sirv = require('../packages/sirv');
+const { Writable } = require('stream');
+
+function runMiddleware(fn, req) {
+	const out = {
+		headers: {},
+		statusCode: -1,
+	}
+	return new Promise((resolve, reject) => {
+		const res = new Writable({
+			write() {}
+		});
+		Object.defineProperty(res, 'statusCode', {
+			set(value) {
+				out.statusCode = value;
+			}
+		})
+		res.on('error', reject)
+		res.on('finish', resolve);
+		res.writeHead = (code, headers) => {
+			out.statusCode = code;
+			Object.assign(out.headers, headers);
+		}
+		fn(req, res);
+	}).then(() => out);
+}
 
 test('exports', t => {
 	t.is(typeof sirv, 'function', 'exports a function');
 	t.end();
 });
+
+test('prevents directory traversal attacks', t => {
+	const request = {
+		headers: {},
+		path: encodeURIComponent('../package.json'),
+	};
+
+	t.plan(1)
+	runMiddleware(
+		sirv(__dirname),
+		request
+	)
+	.then(response => {
+		t.is(response.statusCode, 404);
+		t.end();
+	})
+	.catch(err => {
+		t.fail(err.message)
+	});
+});
+
+test('prevents directory traversal attacks in dev mode', t => {
+	const request = {
+		headers: {},
+		path: encodeURIComponent('../package.json'),
+	};
+
+	t.plan(1)
+	runMiddleware(
+		sirv(__dirname, { dev: true }),
+		request
+	)
+	.then(response => {
+		t.is(response.statusCode, 404);
+		t.end();
+	})
+	.catch(err => {
+		t.fail(err.message)
+	});
+});