@newrelic/preflight 1.4.13 → 1.4.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,18 +1,3 @@
|
|
|
1
1
|
import { IncomingMessage, ServerResponse } from 'node:http';
|
|
2
|
-
/**
|
|
3
|
-
* True if `target` resolves to a path inside `root`. Both branches are
|
|
4
|
-
* literal string checks ('/' and '\\') and must stay that way — never
|
|
5
|
-
* replace either with a `path.sep`-derived value.
|
|
6
|
-
*
|
|
7
|
-
* Dropping the backslash branch breaks static asset serving on Windows,
|
|
8
|
-
* where resolve()/join() produce backslash-joined paths that a '/'-only
|
|
9
|
-
* check never matches. Making either branch non-literal (e.g. concatenating
|
|
10
|
-
* a runtime `sep` variable instead of a quoted character) breaks static
|
|
11
|
-
* analysis: CodeQL cannot statically prove that a runtime separator value
|
|
12
|
-
* equals '/', so it stops recognising this as the standard
|
|
13
|
-
* path-containment sanitizer pattern and flags the file reads below as
|
|
14
|
-
* path injection.
|
|
15
|
-
*/
|
|
16
|
-
export declare function isWithinRoot(root: string, target: string): boolean;
|
|
17
2
|
export declare function createStaticHandler(rootDir: string): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
|
|
18
3
|
//# sourceMappingURL=static-handler.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA0C5D,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GACd,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA6F9D"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { readFile, stat } from 'node:fs/promises';
|
|
2
|
-
import { extname, join, resolve, sep } from 'node:path';
|
|
2
|
+
import { extname, join, relative, isAbsolute, resolve, sep } from 'node:path';
|
|
3
3
|
const MIME = {
|
|
4
4
|
'.html': 'text/html; charset=utf-8',
|
|
5
5
|
'.js': 'application/javascript; charset=utf-8',
|
|
@@ -20,23 +20,6 @@ const MIME = {
|
|
|
20
20
|
'.avif': 'image/avif',
|
|
21
21
|
'.txt': 'text/plain; charset=utf-8',
|
|
22
22
|
};
|
|
23
|
-
/**
|
|
24
|
-
* True if `target` resolves to a path inside `root`. Both branches are
|
|
25
|
-
* literal string checks ('/' and '\\') and must stay that way — never
|
|
26
|
-
* replace either with a `path.sep`-derived value.
|
|
27
|
-
*
|
|
28
|
-
* Dropping the backslash branch breaks static asset serving on Windows,
|
|
29
|
-
* where resolve()/join() produce backslash-joined paths that a '/'-only
|
|
30
|
-
* check never matches. Making either branch non-literal (e.g. concatenating
|
|
31
|
-
* a runtime `sep` variable instead of a quoted character) breaks static
|
|
32
|
-
* analysis: CodeQL cannot statically prove that a runtime separator value
|
|
33
|
-
* equals '/', so it stops recognising this as the standard
|
|
34
|
-
* path-containment sanitizer pattern and flags the file reads below as
|
|
35
|
-
* path injection.
|
|
36
|
-
*/
|
|
37
|
-
export function isWithinRoot(root, target) {
|
|
38
|
-
return target.startsWith(root + '/') || target.startsWith(root + '\\');
|
|
39
|
-
}
|
|
40
23
|
async function serveIndexFallback(root, res) {
|
|
41
24
|
try {
|
|
42
25
|
const indexPath = join(root, 'index.html');
|
|
@@ -62,16 +45,30 @@ export function createStaticHandler(rootDir) {
|
|
|
62
45
|
const url = req.url ?? '/';
|
|
63
46
|
const reqPath = url.split('?')[0] ?? '/';
|
|
64
47
|
const filename = reqPath === '/' ? 'index.html' : reqPath.replace(/^\/+/, '');
|
|
65
|
-
// Reject null bytes and explicit traversal
|
|
66
|
-
// resolve() would eliminate
|
|
67
|
-
//
|
|
68
|
-
|
|
48
|
+
// Reject an empty filename, null bytes, and explicit traversal
|
|
49
|
+
// components before path resolution. resolve() would eliminate '..'
|
|
50
|
+
// segments too, but the explicit check here makes the sanitization
|
|
51
|
+
// visible to static analysis (CodeQL js/path-injection), and rejecting
|
|
52
|
+
// an empty filename here — rather than letting it fall through to a
|
|
53
|
+
// directory stat() — keeps a malformed URL like `//` returning 403,
|
|
54
|
+
// not 404.
|
|
55
|
+
if (filename === '' || filename.includes('\0') || filename.split('/').some((c) => c === '..')) {
|
|
69
56
|
res.writeHead(403);
|
|
70
57
|
res.end();
|
|
71
58
|
return;
|
|
72
59
|
}
|
|
73
60
|
const target = resolve(join(root, filename));
|
|
74
|
-
|
|
61
|
+
// path.relative() plus this escape check is the containment pattern
|
|
62
|
+
// CodeQL recognises as a path-injection sanitizer for the reads below.
|
|
63
|
+
// An `||` of two startsWith() checks (the previous approach, needed to
|
|
64
|
+
// handle both '/' and '\\') is never recognised — inlined or not — and
|
|
65
|
+
// a single-branch check can't cover Windows. This must stay inlined
|
|
66
|
+
// here, not delegated to a helper function: routing the identical
|
|
67
|
+
// check through a separate function also breaks CodeQL's recognition
|
|
68
|
+
// of it. Both of these were confirmed by pushing each shape to a real
|
|
69
|
+
// CodeQL-scanned branch and checking the analysis result directly.
|
|
70
|
+
const rel = relative(root, target);
|
|
71
|
+
if (rel.startsWith('..') || isAbsolute(rel)) {
|
|
75
72
|
res.writeHead(403);
|
|
76
73
|
res.end();
|
|
77
74
|
return;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG9E,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;IACzC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAmB;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,0BAA0B;YAC1C,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,mEAAmE;YACnE,gEAAgE;YAChE,gBAAgB;YAChB,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE9E,+DAA+D;QAC/D,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,WAAW;QACX,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAExC,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,wDAAwD;gBACxD,mEAAmE;gBACnE,+DAA+D;gBAC/D,gEAAgE;gBAChE,2BAA2B;gBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,0DAA0D;YAC1D,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,iDAAiD;YACjD,sEAAsE;YACtE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,QAAQ,KAAK,YAAY,CAAC;YAC9C,MAAM,YAAY,GAAG,WAAW;gBAC9B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,qBAAqB,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrC,eAAe,EAAE,YAAY;aAC9B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
|