Security fixes pass #2

2026-04-19 16:00:59 +01:00
parent 3b26292124
commit b702e26bf6
40 changed files with 305 additions and 93 deletions
@@ -2,13 +2,14 @@ import grabDirNames from "../../utils/grab-dir-names";
 import path from "path";
 import isDevelopment from "../../utils/is-development";
 import { readFileResponse } from "./handle-public";
+import isSafePath from "../../utils/is-safe-path";
 const { BUNEXT_PUBLIC_DIR } = grabDirNames();
 export default async function ({ req }) {
    try {
        const is_dev = isDevelopment();
        const url = new URL(req.url);
        const file_path = path.join(BUNEXT_PUBLIC_DIR, url.pathname.replace(/\/\.bunext\/public\//, ""));
-        if (!file_path.startsWith(BUNEXT_PUBLIC_DIR + path.sep)) {
+        if (!isSafePath({ filePath: file_path, allowedDir: BUNEXT_PUBLIC_DIR })) {
            return new Response("Forbidden", { status: 403 });
        }
        return readFileResponse({