fix(server): normalize file path to ensure path stays within ProjectRootPath #428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

bluefchen wants to merge 1 commit into zh-lx:main from bluefchen:file-path-resolve

+1 −1

bluefchen commented Nov 24, 2025

fix http://localhost:port?file=../../../../etc/passwd can open passwd

Use path.resolve(ProjectRootPath, file) to normalize incoming paths
Ensure the resolved path stays within ProjectRootPath
Block traversal patterns like ?file=../../../../etc/passwd


          fix(server): normalize file path with resolve to block traversal

6e948a9

zh-lx closed this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet