krakenjs / lusca

Application security for express apps.
Other
1.79k stars 139 forks source link

fix blacklist or whitelist judge error #122

Closed Priccc closed 5 years ago

Priccc commented 6 years ago

when my blacklist is [ '/a', '/b ] and my request is '/a', the blacklist is not working

in csrf.js file

if (blacklist) {
    blacklist.some(function (exclusion) {
        shouldBypass = req.path.indexOf(exclusion) === 0;
    });
}

if (whitelist) {
    whitelist.some(function (inclusion) {
        shouldBypass = req.path.indexOf(inclusion) !== 0;
    });
}

i think Array.some() use error And should like this

if (blacklist) {
  shouldBypass = blacklist.some(function (exclusion) {
      return req.path.indexOf(exclusion) === 0;
  });
}

if (whitelist) {
  shouldBypass = whitelist.some(function (inclusion) {
      return req.path.indexOf(inclusion) !== 0;
  });
}

And then passed!!

linkRace commented 5 years ago

Same as #121 , merging that one