Fix security vulnerabilities

2026-10-13 15:52:34 +01:00
parent 74103a19c9
commit eefb2ea5d2
46 changed files with 375 additions and 403 deletions
@@ -8,7 +8,7 @@ export default async function ({ req }) {
    try {
        const is_dev = isDevelopment();
        const url = new URL(req.url);
-        const file_path = path.join(BUNEXT_PUBLIC_DIR, url.pathname.replace(/\/\.bunext\/public\//, ""));
+        const file_path = path.join(BUNEXT_PUBLIC_DIR, decodeURIComponent(url.pathname).replace(/\/\.bunext\/public\//, ""));
        if (!isSafePath({ filePath: file_path, allowedDir: BUNEXT_PUBLIC_DIR })) {
            return new Response("Forbidden", { status: 403 });
        }