path-sanitizer 1.0.0 → 2.0.0

package/README.md

@@ -1,2 +1,37 @@
 # path-sanitizer
- A simple node.js package for sanitizing paths to prevent Path Traversal
+ A simple leightweight node.js package for sanitizing paths to prevent Path Traversal
+
+# Usage
+```js
+const sanitize = require('path-sanitizer')
+
+console.log(sanitize('path/to/file.txt'))
+```
+
+Or here is a more complex example:
+```js
+const sanitize = require('../sanitize')
+const path = require('path')
+
+// Real scenario:
+function routeHandler (myPath) {
+    // Lets just assume that the path was extracted from the request
+    // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
+    // But the user should be able to access C:\Users\user\Desktop\
+    // So we need to sanitize the path
+
+    const APP_DIR = 'C:\\Users\\user\\Desktop\\myApp\\'
+    const sanitized = path.join(APP_DIR, sanitize(myPath))
+
+    // Now we would usally read the file
+    // But in this case we just gonna print the path
+    console.log(sanitized)
+}
+
+routeHandler('myvideo.mp4') // Just fine...
+routeHandler('../../Documents/grades.docx') // But what if we try to access a file outside the app directory?
+routeHandler('/hello.txt') // What if the path starts with a slash, and we try to use an absolute path?
+routeHandler('////////a\\\\../hhuio.txt') // What if the path is not valid?
+routeHandler(500) // What if the path is not a string?
+routeHandler('/:11^^') // What if the path contains not allowed characters (like ":")?
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "path-sanitizer",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "A simple node.js package for sanitizing paths to prevent Path Traversal",
   "main": "sanitize.js",
   "scripts": {

package/sanitize.js

@@ -1,5 +1,72 @@
-function sanitize () {
-    
+const path = require('path')
+
+const DEFAULT_OPTIONS = {
+    decode: [
+        {
+            regex: /%2e/g,
+            replacement: '.'
+        },
+        {
+            regex: /%2f/g,
+            replacement: '/'
+        },
+        {
+            regex: /%5c/g,
+            replacement: '\\'
+        }
+    ],
+    parentDirectoryRegEx: /[\/\\]\.\.[\/\\]/g,
+    notAllowedRegEx: /:|\$|!|'|"|@|\+|`|\||=/g
+}
+
+function sanitize (pathToSanitize, options = DEFAULT_OPTIONS) {
+    if (!options) options = DEFAULT_OPTIONS
+    if (typeof options !== 'object') throw new Error('options must be an object')
+    if (!options.decode) options.decode = DEFAULT_OPTIONS.decode
+    if (!options.parentDirectoryRegEx) options.parentDirectoryRegEx = DEFAULT_OPTIONS.parentDirectoryRegEx
+    if (!options.notAllowedRegEx) options.notAllowedRegEx = DEFAULT_OPTIONS.notAllowedRegEx
+
+    if (typeof pathToSanitize !== 'string') {
+        // Stringify the path
+        pathToSanitize = `${pathToSanitize}`
+    }
+
+    let sanitizedPath = pathToSanitize
+
+    // Decode
+    options.decode.forEach(decode => {
+        sanitizedPath = sanitizedPath.replace(decode.regex, decode.replacement)
+    })
+
+    // Replace first (back)slash with a normal slash
+    sanitizedPath = sanitizedPath.replace(/^[\/\\]?/, '/')
+
+    // Replace /../ with /
+    sanitizedPath = sanitizedPath.replace(options.parentDirectoryRegEx, '/')
+
+    // Replace double (back)slashes with a single slash
+    sanitizedPath = sanitizedPath.replace(/[\/\\]+/g, '/')
+
+    // Normalize path
+    sanitizedPath = path.normalize(sanitizedPath)
+
+    // Remove / or \ in the end
+    while (sanitizedPath.endsWith('/') || sanitizedPath.endsWith('\\')) {
+        sanitizedPath = sanitizedPath.slice(0, -1)
+    }
+
+    // Remove / or \ in the beginning
+    while (sanitizedPath.startsWith('/') || sanitizedPath.startsWith('\\')) {
+        sanitizedPath = sanitizedPath.slice(1)
+    }
+
+    // Validate path
+    sanitizedPath = path.join('', sanitizedPath)
+
+    // Remove not allowed characters
+    sanitizedPath = sanitizedPath.replace(options.notAllowedRegEx, '')
+
+    return sanitizedPath
 }
 
 module.exports = sanitize