fix for path traversal bug (updated)

prahladyeri · Dec 8, 2018 · 3546445 · 3546445
1 parent 8e85a1b
commit 3546445
Show file tree

Hide file tree

Showing 6 changed files with 4 additions and 2 deletions.
diff --git a/.gitignore b/.gitignore
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
diff --git a/LICENSE b/LICENSE
diff --git a/README.md b/README.md
diff --git a/bin/http-live b/bin/http-live
@@ -69,7 +69,9 @@ if (config.minDelay > config.maxDelay) {
 
 http.createServer(function (req, res) {
 	var pathname = url.parse(req.url, true).pathname;
-	pathname = pathname.replace("/../",""); //fix for path traversal bug
+	while(pathname.indexOf("/../") != -1) {
+		pathname = pathname.replace("/../",""); //fix for path traversal bug
+	}
 	var abspath = '';
 	var delay = config.minDelay + Math.floor(Math.random() * (config.maxDelay-config.minDelay));
 	sleep(delay)

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "http-live-simulator",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "HTTP Server that serves with random delay for live simulations",
   "main": "index.js",
   "bin": {