socket-function 0.141.0 → 0.143.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "0.141.0",
+	"version": "0.143.0",
 	"main": "index.js",
 	"license": "MIT",
 	"dependencies": {

package/require/RequireController.ts

@@ -92,6 +92,9 @@ function injectHTMLBeforeStartup(text: string | (() => Promise<string>)) {
 }
 let staticRoots: string[] = [];
 function addStaticRoot(root: string) {
+    if (!root.endsWith("/")) {
+        root += "/";
+    }
     staticRoots.push(root);
 }
 
@@ -131,6 +134,11 @@ class RequireControllerBase {
                 for (let root of staticRoots) {
                     let resolved = root + urlObj.pathname;
                     if (fs.existsSync(resolved)) {
+                        let rootResolved = path.resolve(resolved);
+                        let finalResolved = path.resolve(rootResolved);
+                        if (!finalResolved.startsWith(root)) {
+                            throw new Error(`Invalid access, did not stay in namespace: ${JSON.stringify(root)}, but escaped: ${JSON.stringify(finalResolved)}`);
+                        }
                         result = await fs.promises.readFile(resolved);
                         break;
                     }
@@ -145,7 +153,7 @@ class RequireControllerBase {
                     return setHTTPResultHeaders(result, headers);
                 }
 
-                throw new Error(`Static file not found, ${urlObj.pathname}, have static roots: ${JSON.stringify(staticRoots)}`);
+                return setHTTPResultHeaders(Buffer.from(`Static file not found, ${urlObj.pathname}, have static roots: ${JSON.stringify(staticRoots)}`), headers);
             }
 
         }