Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: thgh/rollup-plugin-serve
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v1.0.1
Choose a base ref
...
head repository: thgh/rollup-plugin-serve
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v1.0.2
Choose a head ref
  • 2 commits
  • 3 files changed
  • 1 contributor

Commits on Jul 17, 2020

  1. Fix path traversal issue

    @thgh
    thgh committed Jul 17, 2020
    Copy the full SHA
    3d144f2 View commit details

  2. v1.0.2

    @thgh
    thgh committed Jul 17, 2020
    Copy the full SHA
    3678e12 View commit details
Showing with 10 additions and 3 deletions.
  1. +4 −0 CHANGELOG.md
  2. +1 −1 package.json
  3. +5 −2 src/index.js
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,10 @@

All notable changes to `rollup-plugin-serve` will be documented in this file.

## [1.0.2] - 2020-07-17
### Fixed
- Fix path traversal issue

## [1.0.1] - 2019-01-27
### Added
- Add Intellisense support #34
2 changes: 1 addition & 1 deletion package.json
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "rollup-plugin-serve",
"version": "1.0.1",
"version": "1.0.2",
"description": "Serve your rolled up bundle",
"main": "dist/index.cjs.js",
"module": "dist/index.es.js",
7 changes: 5 additions & 2 deletions src/index.js
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { readFile } from 'fs'
import { createServer as createHttpsServer } from 'https'
import { createServer } from 'http'
import { resolve } from 'path'
import { resolve, normalize } from 'path'

import mime from 'mime'
import opener from 'opener'
@@ -26,7 +26,10 @@ function serve (options = { contentBase: '' }) {

const requestListener = (request, response) => {
// Remove querystring
const urlPath = decodeURI(request.url.split('?')[0])
const unsafePath = decodeURI(request.url.split('?')[0])

// Don't allow path traversal
const urlPath = normalize(unsafePath)

Object.keys(options.headers).forEach((key) => {
response.setHeader(key, options.headers[key])