Merge pull request #148 from adrianlang/master

Fix directory traversal
2011-09-01 14:36:23 -07:00 · 2011-09-01 14:36:23 -07:00 · a1a1017bfe
commit a1a1017bfe
parent 7e4bba0e31 86d3b2ba81
1 changed files with 2 additions and 1 deletions
--- a/node/server.js
+++ b/node/server.js
@ -99,7 +99,8 @@ async.waterfall([
    app.get('/static/*', function(req, res)
    { 
      res.header("Server", serverName);
-      var filePath = path.normalize(__dirname + "/.." + req.url.split("?")[0]);
+      var filePath = path.normalize(__dirname + "/.." +
+                                    req.url.replace(/\./g, '').split("?")[0]);
      res.sendfile(filePath, { maxAge: exports.maxAge });
    });