kopia lustrzana https://github.com/c9/core
Merge pull request +13387 from c9/ide-catch_uri_malformed_errors
decodeURIComponent can throwpull/290/head
commit
988eb7c811
|
@ -1,9 +1,16 @@
|
|||
"use strict";
|
||||
|
||||
var Path = require("path");
|
||||
var error = require("http-error");
|
||||
|
||||
module.exports = function sanitzePreviewPath(req, res, next) {
|
||||
var normalized = Path.normalize(decodeURIComponent(req.params.path));
|
||||
|
||||
var normalized;
|
||||
try {
|
||||
normalized = Path.normalize(decodeURIComponent(req.params.path));
|
||||
} catch(e) {
|
||||
return next(new error.BadRequest("URI malformed"));
|
||||
}
|
||||
|
||||
// N.B. Path.normalize does not strip away when the path starts with "../"
|
||||
if (normalized)
|
||||
|
|
Ładowanie…
Reference in New Issue