I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned about it. The app is using Express.JS, and no PHP.
My question is if the input is not handled carefully, is it still vulnerable to PHP wrappers?
The app is using JS(express) and no PHP, so my first question is if the input is not handled carefully is it still vulnerable to PHP wrappers?
PHP wrappers concerns php based application and has nothing to do with ways express js handles data.
I've written a small function to sanitize user input. Please tell me if it vulnerable in an environment where the path parameter is being prepended using the below function prepare for getting an absolute path that is then used as input to res.sendFile().
The code will not prevent you from getting hacked if the logic behind it is incorrect. The LFI not only means inclusion of local system files but also file uploaded by attacker to spawn shell as an attempt for escalation of privileges. In such case ../ shall not be the only thing to look for.
In the app's request flow's last step, consider this as suggested addition:
res.sendFile((if possible)check if the intended page will be prepared and it is surely not from system files or the page to be prepared belongs from specific directory of the server & then prepare(page))
