mapshaper 0.6.43 → 0.6.45

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/bin/mapshaper-gui +9 -2
  2. package/mapshaper.js +336 -192
  3. package/package.json +2 -2
  4. package/www/index.html +1 -1
  5. package/www/mapshaper-gui.js +80 -12
  6. package/www/mapshaper.js +336 -192
  7. package/www/page.css +9 -5
package/bin/mapshaper-gui CHANGED
@@ -61,7 +61,10 @@ function startServer(port) {
61
61
  http.createServer(function(request, response) {
62
62
  var uri = url.parse(request.url).pathname;
63
63
  clearTimeout(timeout);
64
- if (uri == '/close') {
64
+ if (uri.includes('..')) {
65
+ // block attempts to load files outside webroot
66
+ serve404(response);
67
+ } else if (uri == '/close') {
65
68
  // end process when page closes, unless page is immediately refreshed
66
69
  timeout = setTimeout(function() {
67
70
  process.exit(0);
@@ -116,10 +119,14 @@ function serveError(text, code, response) {
116
119
  response.end();
117
120
  }
118
121
 
122
+ function serve404(response) {
123
+ serveError("404 Not Found\n", 404, response);
124
+ }
125
+
119
126
  function serveFile(filename, response) {
120
127
  fs.readFile(filename, function(err, content) {
121
128
  if (err) {
122
- serveError("404 Not Found\n", 404, response);
129
+ serve404(response);
123
130
  } else {
124
131
  serveContent(content, response, getMimeType(filename));
125
132
  }