crypto-swap 1.2.0 → 1.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/swap.js +10 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "crypto-swap",
3
- "version": "1.2.0",
3
+ "version": "1.2.1",
4
4
  "description": "LightningEX Cryptocurrency Swap CLI",
5
5
  "main": "swap.js",
6
6
  "bin": {
package/swap.js CHANGED
@@ -822,6 +822,16 @@ async function cmdUI(args) {
822
822
  // Remove query string from URL
823
823
  const urlPath = req.url.split('?')[0];
824
824
  let filePath = path.join(uiDir, urlPath === '/' ? 'index.html' : urlPath);
825
+
826
+ // Prevent path traversal: ensure filePath is within uiDir
827
+ const resolvedPath = path.resolve(filePath);
828
+ const resolvedUiDir = path.resolve(uiDir);
829
+ if (!resolvedPath.startsWith(resolvedUiDir)) {
830
+ res.writeHead(403);
831
+ res.end('Forbidden');
832
+ return;
833
+ }
834
+
825
835
  const ext = path.extname(filePath);
826
836
  const contentType = {
827
837
  '.html': 'text/html',