@rhinostone/swig-core 2.7.0 → 2.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/loaders/filesystem.js +18 -2
- package/package.json +1 -1
|
@@ -11,8 +11,9 @@ var fs = require('fs'),
|
|
|
11
11
|
* swig.setDefaults({ loader: swig.loaders.fs(__dirname + '/templates' )});
|
|
12
12
|
* @param {string} [basepath=''] Path to the templates as string. Assigning this value allows you to use semi-absolute paths to templates instead of relative paths.
|
|
13
13
|
* @param {string} [encoding='utf8'] Template encoding
|
|
14
|
+
* @param {boolean} [allowOutsideRoot=false] When false (default) and a <var>basepath</var> is set, template paths that resolve outside the basepath root are rejected (CVE-2023-25345 path-traversal hardening). Set true to permit includes / extends that intentionally read files from outside the template root.
|
|
14
15
|
*/
|
|
15
|
-
module.exports = function (basepath, encoding) {
|
|
16
|
+
module.exports = function (basepath, encoding, allowOutsideRoot) {
|
|
16
17
|
var ret = {};
|
|
17
18
|
|
|
18
19
|
encoding = encoding || 'utf8';
|
|
@@ -26,12 +27,27 @@ module.exports = function (basepath, encoding) {
|
|
|
26
27
|
* @return {string}
|
|
27
28
|
*/
|
|
28
29
|
ret.resolve = function (to, from) {
|
|
30
|
+
var resolved, rootWithSep;
|
|
29
31
|
if (basepath) {
|
|
30
32
|
from = basepath;
|
|
31
33
|
} else {
|
|
32
34
|
from = (from) ? path.dirname(from) : process.cwd();
|
|
33
35
|
}
|
|
34
|
-
|
|
36
|
+
resolved = path.resolve(from, to);
|
|
37
|
+
|
|
38
|
+
// CVE-2023-25345: reject include / extends / import paths that resolve
|
|
39
|
+
// outside the configured loader root (e.g. "../../../etc/passwd"),
|
|
40
|
+
// including when the path is supplied by an untrusted runtime variable
|
|
41
|
+
// ({% include userVar %}). Enforced only when a basepath defines the
|
|
42
|
+
// root; pass allowOutsideRoot === true to opt out for the rare case of
|
|
43
|
+
// legitimately including files from outside the template root.
|
|
44
|
+
if (basepath && !allowOutsideRoot) {
|
|
45
|
+
rootWithSep = path.normalize(basepath + path.sep);
|
|
46
|
+
if (resolved !== basepath && resolved.indexOf(rootWithSep) !== 0) {
|
|
47
|
+
throw new Error('Template "' + to + '" resolves outside the loader root "' + basepath + '" (CVE-2023-25345).');
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
return resolved;
|
|
35
51
|
};
|
|
36
52
|
|
|
37
53
|
/**
|