mockaton 8.7.5 → 8.7.6

package/package.json

@@ -2,7 +2,7 @@
 	"name": "mockaton",
 	"description": "A deterministic server-side for developing and testing frontend clients",
 	"type": "module",
-	"version": "8.7.5",
+	"version": "8.7.6",
 	"main": "index.js",
 	"types": "index.d.ts",
 	"license": "MIT",

package/src/Mockaton.test.js

@@ -500,6 +500,11 @@ export default function (req, response) {
 
 async function testStaticFileServing() {
 	await describe('Static File Serving', () => {
+		it('404 path traversal', async () => {
+			const res = await request('/../../../etc/passwd')
+			equal(res.status, 404)
+		})
+
 		it('Defaults to index.html', async () => {
 			const res = await request('/')
 			const body = await res.text()

package/src/StaticDispatcher.js

@@ -1,4 +1,4 @@
-import { join, isAbsolute } from 'node:path'
+import { join, resolve } from 'node:path'
 import fs, { readFileSync } from 'node:fs'
 
 import { config } from './config.js'
@@ -8,12 +8,15 @@ import { sendNotFound, sendInternalServerError } from './utils/http-response.js'
 
 
 export function isStatic(req) {
-	if (!config.staticDir)
-		return false
-	if (!isAbsolute(req.url)) // prevent sandbox escape
+	if (!config.staticDir || !isWithinStaticDir(req.url))
 		return false
 	const f = resolvePath(req.url)
-	return !config.ignore.test(f) && Boolean(f)
+	return f && !config.ignore.test(f)
+}
+
+function isWithinStaticDir(url) {
+	const candidate = resolve(join(config.staticDir, url))
+	return candidate.startsWith(config.staticDir)
 }
 
 export async function dispatchStatic(req, response) {
@@ -29,7 +32,7 @@ export async function dispatchStatic(req, response) {
 function resolvePath(url) {
 	let candidate = join(config.staticDir, url)
 	if (isDirectory(candidate))
-		candidate += '/index.html'
+		candidate = join(candidate, 'index.html')
 	if (isFile(candidate))
 		return candidate
 }

package/src/config.js

@@ -1,3 +1,4 @@
+import { resolve } from 'node:path'
 import { isDirectory } from './utils/fs.js'
 import { openInBrowser } from './utils/openInBrowser.js'
 import { jsToJsonPlugin } from './MockDispatcherPlugins.js'
@@ -66,6 +67,9 @@ export function setup(options) {
 
 		onReady: is(Function)
 	})
+
+	config.mocksDir = resolve(config.mocksDir)
+	config.staticDir = resolve(config.staticDir)
 }