strdst7/Arah2
1
0
Fork 0
forked from c-fu/arah2
Code Pull Requests Activity

fix(01-design-tokens-rams-foundation): WR-05 static server docroot guard ends prefix with separator

Browse Source
This commit is contained in:
araharah-executor
2026-10-22 09:39:30 +08:00
parent 5e254cb851
commit 43b7d991e4
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
theme/scripts/screenshot.mjs
+5 -2
View File
@@ -32,7 +32,7 @@
import { createServer } from 'node:http'; import { createServer } from 'node:http';
import { copyFileSync, existsSync, mkdirSync, statSync } from 'node:fs'; import { copyFileSync, existsSync, mkdirSync, statSync } from 'node:fs';
import { readFile } from 'node:fs/promises'; import { readFile } from 'node:fs/promises';
import { dirname, extname, join, resolve } from 'node:path'; import { dirname, extname, join, resolve, sep } from 'node:path';
import { fileURLToPath, pathToFileURL } from 'node:url'; import { fileURLToPath, pathToFileURL } from 'node:url';
import { chromium } from 'playwright'; import { chromium } from 'playwright';
@@ -67,7 +67,10 @@ function serveTheme() {
try { try {
const url = new URL(req.url, 'http://127.0.0.1'); const url = new URL(req.url, 'http://127.0.0.1');
const target = join(THEME, decodeURIComponent(url.pathname)); const target = join(THEME, decodeURIComponent(url.pathname));
if (!target.startsWith(THEME)) { /* docroot guard: the prefix must end with a separator — a bare
* startsWith(THEME) lets sibling theme* paths (e.g. a decoded
* ..%2FthemeX) escape the docroot (WR-05). */
if (target !== THEME && !target.startsWith(THEME + sep)) {
res.writeHead(403); res.writeHead(403);
res.end('forbidden'); res.end('forbidden');
return; return;