Fortify user data path checks

ff8b029c9dc92d0f553eaf9dfecf117a49a4b53e

Cohee <18619528+Cohee1207@users.noreply.github.com>

src/users.js+16 -5 Viewed

 import sanitize from 'sanitize-filename';
 import { USER_DIRECTORY_TEMPLATE, DEFAULT_USER, PUBLIC_DIRECTORIES, SETTINGS_FILE, UPLOADS_DIRECTORY } from './constants.js';
 import { getConfigValue, color, delay, generateTimestamp, invalidateFirefoxCache, isPathUnderParent } from './util.js';
 import { readSecret, writeSecret } from './endpoints/secrets.js';
 import { getContentOfType } from './endpoints/content-manager.js';
 import { serverDirectory } from './server-directory.js';

         try {
             const directory = directoryFn(req);
             const filePath = decodeURIComponent(req.params[0]);
             const existsfullPath = fs.existsSync(path.join(directory, filePath));
 +            if (!isPathUnderParent(directory, path.resolve(fullPath))) {
 +                return res.sendStatus(403);
 +            }
 +            const exists = fs.existsSync(fullPath);
             if (!exists) {
                 return res.sendStatus(404);
+            }

         try {
             const directory = directoryFn(req);
             const filePath = decodeURIComponent(req.params[0]);
+-
 +            const localPath = path.join(directory, filePath);
 -            const existsLocal = fs.existsSync(path.join(directory, filePath));
 +            if (!isPathUnderParent(directory, path.resolve(localPath))) {
 +                return res.sendStatus(403);
 +            }
 +            const existsLocal = fs.existsSync(localPath);
             if (existsLocal) {
                 return res.sendFile(filePath, { root: directory });
+            }
             const existsGlobalglobalPath = fs.existsSync(path.join(PUBLIC_DIRECTORIES.globalExtensions, filePath));
 +            if (!isPathUnderParent(PUBLIC_DIRECTORIES.globalExtensions, path.resolve(globalPath))) {
 +                return res.sendStatus(403);
 +            }
 +            const existsGlobal = fs.existsSync(globalPath);
             if (existsGlobal) {
                 return res.sendFile(filePath, { root: PUBLIC_DIRECTORIES.globalExtensions });
+            }