search

cloudhead / node-static

rfc 2616 compliant HTTP static-file server module, with built-in caching.
MIT License
2.17k stars 245 forks source link

Prevent DoS attack #213

Closed Zarel closed 3 years ago

Zarel commented 5 years ago

A pathname containing U+0000 NULL will crash fs.stat with the error message "TypeError [ERR_INVALID_ARG_VALUE]: The argument 'path' must be a string or Uint8Array without null bytes."

This commit prevents node-static from crashing.

tchakabam commented 5 years ago

shouldn't this be related to / fixed in the specific Node runtime in use?

Zarel commented 5 years ago

It looks like this is new in Node.js v10:

https://alexatnet.com/node-js-10-important-changes/#fs-2

In previous Node versions, it would be passed as an error to the fs.stat callback, so it would respond with a 404:

        fs.stat(pathname, function (e, stat) {
            if (e) {
                finish(404, {});

But in Node 10 and later, fs.stat instead synchronously throws an error.

Zarel commented 5 years ago

https://github.com/nodejs/node/pull/18308

is the change in Node.js that led to this regression.

lovasoa commented 4 years ago

This is a serious security issue. What is the state of this PR ?

kashif-m commented 3 years ago

Why is this still not closed? 🤔

brettz9 commented 3 years ago

Closing as #227 avoids need for this PR.