@eik/core 2.2.1 → 2.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/lib/handlers/alias.get.js +14 -0
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,17 @@
|
|
|
1
|
+
## [2.2.3](https://github.com/eik-lib/core/compare/v2.2.2...v2.2.3) (2026-08-22)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Bug Fixes
|
|
5
|
+
|
|
6
|
+
* **deps:** update dependency @eik/sink-memory to v2.2.2 ([#646](https://github.com/eik-lib/core/issues/646)) ([61841b8](https://github.com/eik-lib/core/commit/61841b8f9053132795e144fca2279ee7e98e128b))
|
|
7
|
+
|
|
8
|
+
## [2.2.2](https://github.com/eik-lib/core/compare/v2.2.1...v2.2.2) (2026-08-21)
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
### Bug Fixes
|
|
12
|
+
|
|
13
|
+
* reject path traversal in alias extras and validate redirect location ([#645](https://github.com/eik-lib/core/issues/645)) ([be1a9ef](https://github.com/eik-lib/core/commit/be1a9ef13f520e10d9003fc5988e93d00e9d4d5c))
|
|
14
|
+
|
|
1
15
|
## [2.2.1](https://github.com/eik-lib/core/compare/v2.2.0...v2.2.1) (2026-08-20)
|
|
2
16
|
|
|
3
17
|
|
|
@@ -4,6 +4,8 @@ import HttpError from "http-errors";
|
|
|
4
4
|
import abslog from "abslog";
|
|
5
5
|
import Metrics from "@metrics/client";
|
|
6
6
|
|
|
7
|
+
const RE_EXTERNAL_LOCATION = /^\/\/|^https?:\/\//i;
|
|
8
|
+
|
|
7
9
|
import { decodeUriComponent, readJSON } from "../utils/utils.js";
|
|
8
10
|
import { createURIToTargetOfAlias } from "../utils/path-builders-uri.js";
|
|
9
11
|
import { createFilePathToAlias } from "../utils/path-builders-fs.js";
|
|
@@ -96,6 +98,18 @@ const AliasGet = class AliasGet {
|
|
|
96
98
|
const obj = await readJSON(this._sink, path);
|
|
97
99
|
const location = createURIToTargetOfAlias({ extra: pExtra, ...obj });
|
|
98
100
|
|
|
101
|
+
// Defence-in-depth: reject any constructed location that starts with
|
|
102
|
+
// '//' (protocol-relative) or an absolute URL scheme, which would
|
|
103
|
+
// redirect outside the expected origin.
|
|
104
|
+
if (RE_EXTERNAL_LOCATION.test(location)) {
|
|
105
|
+
this._log.debug(
|
|
106
|
+
`alias:get - Constructed location escapes expected origin - Pathname: ${path}`,
|
|
107
|
+
);
|
|
108
|
+
const e = new HttpError.NotFound();
|
|
109
|
+
end({ labels: { success: false, status: e.status } });
|
|
110
|
+
throw e;
|
|
111
|
+
}
|
|
112
|
+
|
|
99
113
|
const outgoing = new HttpOutgoing();
|
|
100
114
|
outgoing.cacheControl = this._cacheControl;
|
|
101
115
|
outgoing.statusCode = 302;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@eik/core",
|
|
3
|
-
"version": "2.2.
|
|
3
|
+
"version": "2.2.3",
|
|
4
4
|
"description": "Core server package",
|
|
5
5
|
"main": "lib/main.js",
|
|
6
6
|
"types": "./types/main.d.ts",
|
|
@@ -29,10 +29,9 @@
|
|
|
29
29
|
"author": "",
|
|
30
30
|
"license": "MIT",
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@eik/common": "5.2.0",
|
|
33
32
|
"@eik/sink": "1.2.7",
|
|
34
33
|
"@eik/sink-file-system": "2.2.0",
|
|
35
|
-
"@eik/sink-memory": "2.2.
|
|
34
|
+
"@eik/sink-memory": "2.2.2",
|
|
36
35
|
"@metrics/client": "2.5.5",
|
|
37
36
|
"abslog": "2.4.4",
|
|
38
37
|
"busboy": "1.6.0",
|
|
@@ -44,6 +43,7 @@
|
|
|
44
43
|
"tar": "7.5.22"
|
|
45
44
|
},
|
|
46
45
|
"devDependencies": {
|
|
46
|
+
"@eik/common": "5.2.1",
|
|
47
47
|
"@eik/eslint-config": "2.0.15",
|
|
48
48
|
"@eik/prettier-config": "1.0.2",
|
|
49
49
|
"@eik/semantic-release-config": "1.0.19",
|