Correct regex for outside-of-basedir files

2017-12-17 19:30:51 +02:00 · 2017-12-17 19:30:51 +02:00 · 358746b091
parent 80a61d5f53
commit 358746b091
1 changed files with 1 additions and 1 deletions
--- a/lib/files.js
+++ b/lib/files.js
@ -23,7 +23,7 @@ module.exports = (base, default_price, invoice_ttl, files_attr) => {
        , ext      = fileExt(name)
        , attr     = files_attr[relpath] || {}

-    if (/^\.?\//.test(relpath) || reIgnore.test(name)) throw new Error('forbidden')
+    if (/^\.\.\//.test(relpath) || reIgnore.test(name)) throw new Error('forbidden')

    const file = { fullpath, path: relpath, urlpath: escape(relpath), name, ext, dirname, attr }
        , stat = await fs.stat(fullpath)