Add path traversal

HowProgrammingWorks · Aug 21, 2023 · c1ed77e · c1ed77e
1 parent 5dc514f
commit c1ed77e
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/JavaScript/d-messenger/lib/static.js b/JavaScript/d-messenger/lib/static.js
@@ -28,6 +28,10 @@ module.exports = (root, port, console) => {
     .createServer(async (req, res) => {
       const url = req.url === '/' ? '/index.html' : req.url;
       const filePath = path.join(root, url);
+      if (!filePath.startsWith(root)) {
+        res.statusCode = 404;
+        return void res.end('"File is not found"');
+      }
       try {
         const data = await fs.promises.readFile(filePath);
         const fileExt = path.extname(filePath).substring(1);