fix: asset path traversal on windows

3 years ago · 414033de9d
1 changed files with 2 additions and 0 deletions
--- a/server/helpers/page.js
+++ b/server/helpers/page.js
@ -35,6 +35,8 @@ module.exports = {
    rawPath = rawPath.replace(unsafeCharsRegex, '')
    if (rawPath === '') { rawPath = 'home' }

+    rawPath = rawPath.replaceAll('\\', '').replaceAll('//', '').replaceAll(/\.\.+/ig, '')
+
    // Extract Info
    let pathParts = _.filter(_.split(rawPath, '/'), p => {
      p = _.trim(p)