Open versacall opened 5 years ago
Hi Versacall,
That's definitely a bug, it should not allow you to get files below the basePath.
What you could do to get around this is either copying the StaticFileRouteHandler class or creating a wrapper around StaticFileRouteHandler that throws an exception when a . or .. is specified in the request uri.
The proper fix should:
filePath
to a full absolute path (so without . and .. in the file path)Are you willing / able to attempt fixing this? If not I can probably implement & push a fix this week.
Cheers,
Jark
Yeah, I reviewed the StaticFileRouteHandler class and see what you mean. I'll clone the repo and try out the fix. If it works I'll try and push up the changes if you want. (From this account, I have 2 GitHub accounts which is confusing)
I fixed the issue and made pull request #139.
We have an application running on a Win 10 IoT Core raspberry pi using restup. But it was flagged with a vulnerability from a scan from IT.
Basically if you send something like this from Postman. It returns the contents of the C:\windows\win.ini file.
GET: 192.168.100.37:80/../../../../../../../../../../windows/win.ini
Is there any way to prevent it from going beyond the root of the application? I didn't see anything in the documentation that indicated such an option. I'm not sure if it allows writes/POSTs to those folders but IT is on my case about blocking this vulnerability.