@newrelic/preflight 1.4.12 → 1.4.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,14 +1,3 @@
|
|
|
1
1
|
import { IncomingMessage, ServerResponse } from 'node:http';
|
|
2
|
-
/**
|
|
3
|
-
* True if `target` resolves to a path inside `root`. Checks the literal '/'
|
|
4
|
-
* separator first — kept so static analysis tools (CodeQL js/path-injection)
|
|
5
|
-
* recognise this as the standard path-containment sanitizer pattern, since
|
|
6
|
-
* CodeQL cannot statically prove that node:path's `sep` is '/'. The
|
|
7
|
-
* `platformSep` check is required as a fallback because on Windows
|
|
8
|
-
* resolve()/join() produce backslash-joined paths, which never match a
|
|
9
|
-
* hardcoded '/'. Defaults to the real platform separator; overridable so
|
|
10
|
-
* tests can exercise the Windows branch deterministically on any OS.
|
|
11
|
-
*/
|
|
12
|
-
export declare function isWithinRoot(root: string, target: string, platformSep?: string): boolean;
|
|
13
2
|
export declare function createStaticHandler(rootDir: string): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
|
|
14
3
|
//# sourceMappingURL=static-handler.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA0C5D,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GACd,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA6F9D"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { readFile, stat } from 'node:fs/promises';
|
|
2
|
-
import { extname, join, resolve, sep } from 'node:path';
|
|
2
|
+
import { extname, join, relative, isAbsolute, resolve, sep } from 'node:path';
|
|
3
3
|
const MIME = {
|
|
4
4
|
'.html': 'text/html; charset=utf-8',
|
|
5
5
|
'.js': 'application/javascript; charset=utf-8',
|
|
@@ -20,19 +20,6 @@ const MIME = {
|
|
|
20
20
|
'.avif': 'image/avif',
|
|
21
21
|
'.txt': 'text/plain; charset=utf-8',
|
|
22
22
|
};
|
|
23
|
-
/**
|
|
24
|
-
* True if `target` resolves to a path inside `root`. Checks the literal '/'
|
|
25
|
-
* separator first — kept so static analysis tools (CodeQL js/path-injection)
|
|
26
|
-
* recognise this as the standard path-containment sanitizer pattern, since
|
|
27
|
-
* CodeQL cannot statically prove that node:path's `sep` is '/'. The
|
|
28
|
-
* `platformSep` check is required as a fallback because on Windows
|
|
29
|
-
* resolve()/join() produce backslash-joined paths, which never match a
|
|
30
|
-
* hardcoded '/'. Defaults to the real platform separator; overridable so
|
|
31
|
-
* tests can exercise the Windows branch deterministically on any OS.
|
|
32
|
-
*/
|
|
33
|
-
export function isWithinRoot(root, target, platformSep = sep) {
|
|
34
|
-
return target.startsWith(root + '/') || target.startsWith(root + platformSep);
|
|
35
|
-
}
|
|
36
23
|
async function serveIndexFallback(root, res) {
|
|
37
24
|
try {
|
|
38
25
|
const indexPath = join(root, 'index.html');
|
|
@@ -58,16 +45,30 @@ export function createStaticHandler(rootDir) {
|
|
|
58
45
|
const url = req.url ?? '/';
|
|
59
46
|
const reqPath = url.split('?')[0] ?? '/';
|
|
60
47
|
const filename = reqPath === '/' ? 'index.html' : reqPath.replace(/^\/+/, '');
|
|
61
|
-
// Reject null bytes and explicit traversal
|
|
62
|
-
// resolve() would eliminate
|
|
63
|
-
//
|
|
64
|
-
|
|
48
|
+
// Reject an empty filename, null bytes, and explicit traversal
|
|
49
|
+
// components before path resolution. resolve() would eliminate '..'
|
|
50
|
+
// segments too, but the explicit check here makes the sanitization
|
|
51
|
+
// visible to static analysis (CodeQL js/path-injection), and rejecting
|
|
52
|
+
// an empty filename here — rather than letting it fall through to a
|
|
53
|
+
// directory stat() — keeps a malformed URL like `//` returning 403,
|
|
54
|
+
// not 404.
|
|
55
|
+
if (filename === '' || filename.includes('\0') || filename.split('/').some((c) => c === '..')) {
|
|
65
56
|
res.writeHead(403);
|
|
66
57
|
res.end();
|
|
67
58
|
return;
|
|
68
59
|
}
|
|
69
60
|
const target = resolve(join(root, filename));
|
|
70
|
-
|
|
61
|
+
// path.relative() plus this escape check is the containment pattern
|
|
62
|
+
// CodeQL recognises as a path-injection sanitizer for the reads below.
|
|
63
|
+
// An `||` of two startsWith() checks (the previous approach, needed to
|
|
64
|
+
// handle both '/' and '\\') is never recognised — inlined or not — and
|
|
65
|
+
// a single-branch check can't cover Windows. This must stay inlined
|
|
66
|
+
// here, not delegated to a helper function: routing the identical
|
|
67
|
+
// check through a separate function also breaks CodeQL's recognition
|
|
68
|
+
// of it. Both of these were confirmed by pushing each shape to a real
|
|
69
|
+
// CodeQL-scanned branch and checking the analysis result directly.
|
|
70
|
+
const rel = relative(root, target);
|
|
71
|
+
if (rel.startsWith('..') || isAbsolute(rel)) {
|
|
71
72
|
res.writeHead(403);
|
|
72
73
|
res.end();
|
|
73
74
|
return;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG9E,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;IACzC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAmB;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,0BAA0B;YAC1C,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,mEAAmE;YACnE,gEAAgE;YAChE,gBAAgB;YAChB,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE9E,+DAA+D;QAC/D,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,WAAW;QACX,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAExC,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,wDAAwD;gBACxD,mEAAmE;gBACnE,+DAA+D;gBAC/D,gEAAgE;gBAChE,2BAA2B;gBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,0DAA0D;YAC1D,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,iDAAiD;YACjD,sEAAsE;YACtE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,QAAQ,KAAK,YAAY,CAAC;YAC9C,MAAM,YAAY,GAAG,WAAW;gBAC9B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,qBAAqB,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrC,eAAe,EAAE,YAAY;aAC9B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
|