mockaton 8.7.5 → 8.7.7

package/package.json

@@ -2,7 +2,7 @@
 	"name": "mockaton",
 	"description": "A deterministic server-side for developing and testing frontend clients",
 	"type": "module",
-	"version": "8.7.5",
+	"version": "8.7.7",
 	"main": "index.js",
 	"types": "index.d.ts",
 	"license": "MIT",

package/src/Mockaton.test.js

@@ -500,6 +500,11 @@ export default function (req, response) {
 
 async function testStaticFileServing() {
 	await describe('Static File Serving', () => {
+		it('404 path traversal', async () => {
+			const res = await request('/../../../etc/passwd')
+			equal(res.status, 404)
+		})
+
 		it('Defaults to index.html', async () => {
 			const res = await request('/')
 			const body = await res.text()

package/src/StaticDispatcher.js

@@ -1,5 +1,5 @@
-import { join, isAbsolute } from 'node:path'
-import fs, { readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import fs, { readFileSync, realpathSync } from 'node:fs'
 
 import { config } from './config.js'
 import { mimeFor } from './utils/mime.js'
@@ -10,14 +10,12 @@ import { sendNotFound, sendInternalServerError } from './utils/http-response.js'
 export function isStatic(req) {
 	if (!config.staticDir)
 		return false
-	if (!isAbsolute(req.url)) // prevent sandbox escape
-		return false
-	const f = resolvePath(req.url)
-	return !config.ignore.test(f) && Boolean(f)
+	const f = resolvedAllowedPath(req.url)
+	return f && !config.ignore.test(f)
 }
 
 export async function dispatchStatic(req, response) {
-	const file = resolvePath(req.url)
+	const file = resolvedAllowedPath(req.url)
 	if (!file)
 		sendNotFound(response)
 	else if (req.headers.range)
@@ -26,11 +24,14 @@ export async function dispatchStatic(req, response) {
 		sendFile(response, file)
 }
 
-function resolvePath(url) {
-	let candidate = join(config.staticDir, url)
+function resolvedAllowedPath(url) {
+	let candidate = resolve(join(config.staticDir, url))
 	if (isDirectory(candidate))
-		candidate += '/index.html'
-	if (isFile(candidate))
+		candidate = join(candidate, 'index.html')
+	if (!isFile(candidate))
+		return false
+	candidate = realpathSync(candidate)
+	if (candidate.startsWith(config.staticDir))
 		return candidate
 }
 

package/src/config.js

@@ -1,3 +1,4 @@
+import { realpathSync } from 'node:fs'
 import { isDirectory } from './utils/fs.js'
 import { openInBrowser } from './utils/openInBrowser.js'
 import { jsToJsonPlugin } from './MockDispatcherPlugins.js'
@@ -66,6 +67,9 @@ export function setup(options) {
 
 		onReady: is(Function)
 	})
+
+	config.mocksDir = realpathSync(config.mocksDir)
+	config.staticDir = realpathSync(config.staticDir)
 }