Timeline for How to prevent directory traversal when joining paths in node.js?
Current License: CC BY-SA 4.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 3, 2023 at 22:14 | comment | added | Eran Medan | @MichaelSandino the link seems to be dead, here is the archive.org link web.archive.org/web/20211128060450/https://nodejs.org/en/… | |
| Aug 11, 2022 at 18:13 | comment | added | iono | For security-relevant regexes, make sure to break them into easily-understandable components, thoroughly commenting the intent behind every component. More importantly, security-relevant regexes shouldn't be trusted without a comprehensive test suite. The fact that even this relatively simple one had a bug is a good reminder of their fickleness. | |
| Mar 19, 2020 at 9:17 | comment | added | Michael Sandino |
I don't know what the situation was when this question was originally answered, but there is official NodeJS documentation on how to prevent path traversal. Basically you use path.join to create an absolute path and then check if the result starts with your base path. If not: attempted path traversal. Seems simpler and safer to me.
|
|
| Mar 1, 2019 at 9:07 | comment | added | cloudfeet |
@Brendon - Thanks! Chnged to .replace(/^(\.\.(\/|\\|$))+/, ''), which I think is more succinct.
|
|
| Mar 1, 2019 at 9:06 | history | edited | cloudfeet | CC BY-SA 4.0 |
Handle ".." case
|
| Mar 1, 2019 at 7:34 | comment | added | Brendon Boshell | This does not deal with the case where unsafePrefix = '..'! Perhaps .replace(/^(\.\.[\/\])+/, '').replace(/^(\.\.)$/, '') is safer? | |
| Nov 30, 2018 at 19:42 | comment | added | 3ocene | @cloudfeet, that makes sense. Thanks for clarifying! | |
| Nov 29, 2018 at 15:59 | comment | added | cloudfeet |
@3ocene: That's the reason we use path.normalise() as step 1. It cancels any internal ../, so your example would be converted to ../../whatever before step 2. :)
|
|
| Nov 28, 2018 at 17:52 | comment | added | 3ocene |
A bit late to the party here, but wouldn't this still be vulnerable to path/../../../whatever
|
|
| May 22, 2016 at 15:01 | vote | accept | Anders | ||
| May 22, 2016 at 7:47 | comment | added | cloudfeet |
path.normalize() keeps trailing slashes, so you'd need some extra logic for prefix directories of both public/html and public/html/ to work correctly.
|
|
| May 19, 2016 at 15:36 | comment | added | Anders |
Great answer! Thanks! Concerning your last example, is there any benefit to using path.resolve() to get the absolute path, as opposed to use path.normalize() and stay with relative paths?
|
|
| May 19, 2016 at 13:05 | history | edited | cloudfeet | CC BY-SA 3.0 |
added 599 characters in body
|
| May 19, 2016 at 12:49 | history | edited | cloudfeet | CC BY-SA 3.0 |
added 336 characters in body
|
| May 19, 2016 at 12:44 | history | answered | cloudfeet | CC BY-SA 3.0 |