Skip to content

Comments

fix: /@fs/ dir traversal with escaped chars (fixes #8498)#8804

Merged
patak-dev merged 2 commits intovitejs:mainfrom
sapphi-red:fix/dir-traversal-with-escape
Jun 27, 2022
Merged

fix: /@fs/ dir traversal with escaped chars (fixes #8498)#8804
patak-dev merged 2 commits intovitejs:mainfrom
sapphi-red:fix/dir-traversal-with-escape

Conversation

@sapphi-red
Copy link
Member

@sapphi-red sapphi-red commented Jun 27, 2022

Description

This was happening becasue Vite uses decodeURI and sirv uses decodeURIComponent.

vite/packages/vite/src/node/server/middlewares/static.ts

Line 83 in e53c029

const url = decodeURI(req.url!)

vite/packages/vite/src/node/server/middlewares/static.ts

Line 126 in e53c029

let url = decodeURI(req.url!)

https://github.com/lukeed/sirv/blob/886cc962a345780cd78f8910cdcf218db2a8d955/packages/sirv/index.js#L171

Maybe sirv should use decodeURI instead of decodeURIComponent. But I think changing it have a possibility to break Vite somewhere. So I chose to do like this PR.

fixes #8498

Additional context

What is the purpose of this pull request?

  • Bug fix
  • New Feature
  • Documentation update
  • Other

Before submitting the PR, please make sure you do the following

  • Read the Contributing Guidelines.
  • Read the Pull Request Guidelines and follow the Commit Convention.
  • Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
  • Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
  • Ideally, include relevant tests that fail without this PR but pass with it.

@sapphi-red sapphi-red added bug p5-urgent Fix build-breaking bugs affecting most users, should be released ASAP (priority) security labels Jun 27, 2022
@netlify
Copy link

netlify bot commented Jun 27, 2022 •
edited
Loading

✅ Deploy Preview for vite-docs-main ready!

Name Link
🔨 Latest commit cbc971c
🔍 Latest deploy log https://app.netlify.com/sites/vite-docs-main/deploys/62b924521777ea000864972e
😎 Deploy Preview https://deploy-preview-8804--vite-docs-main.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

@sapphi-red sapphi-red mentioned this pull request Jun 27, 2022
Merged
4 tasks
@patak-dev patak-dev merged commit 6851009 into vitejs:main Jun 27, 2022
patak-dev pushed a commit that referenced this pull request Jun 27, 2022
@sapphi-red
fix: backport #8804, /@fs/ dir traversal with escaped chars (fixes #8498
e109d64 
) (#8805)
@sapphi-red sapphi-red deleted the fix/dir-traversal-with-escape branch June 27, 2022 05:09
@patak-dev patak-dev mentioned this pull request Jun 27, 2022
Closed
7 tasks
This was referenced Jul 7, 2022
Closed
Merged
@sapphi-red sapphi-red mentioned this pull request Jul 18, 2022
Merged
9 tasks
@sapphi-red sapphi-red mentioned this pull request Apr 30, 2023
Merged
9 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@patak-dev patak-dev patak-dev approved these changes

Assignees

No one assigned

Labels

p5-urgent Fix build-breaking bugs affecting most users, should be released ASAP (priority) security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Unrestricted directory traversal with @fs (Bypass)

2 participants

@sapphi-red @patak-dev