koa-static-cache - npm Package Compare versions

Comparing version 5.1.0 to 5.1.1

HISTORY.md

 
+5.1.1 / 2017-06-13
+==================
+
+  * fix: only load file under options.dir (#67)
+
 5.1.0 / 2017-06-01
@@ -3,0 +8,0 @@ ==================

index.js

@@ -22,2 +22,3 @@ var crypto = require('crypto')
   dir = dir || options.dir || process.cwd()
+  dir = path.normalize(dir)
   var enableGzip = !!options.gzip
@@ -57,4 +58,3 @@ var filePrefix = path.normalize(options.prefix.replace(/^\//, ''))
     // normalize for `//index`
-    var filename = safeDecodeURIComponent(path.normalize(ctx.path))
-
+    var filename = path.normalize(safeDecodeURIComponent(ctx.path))
     var file = files.get(filename)
@@ -74,5 +74,11 @@
 
+      var fullpath = path.join(dir, filename)
+      // files that can be accessd should be under options.dir
+      if (fullpath.indexOf(dir) !== 0) {
+        return await next()
+      }
+
       var s
       try {
-        s = await fs.stat(path.join(dir, filename))
+        s = await fs.stat(fullpath)
       } catch (err) {
@@ -79,0 +85,0 @@ return await next()

package.json

 {
   "name": "koa-static-cache",
   "description": "Static cache for koa",
-  "version": "5.1.0",
+  "version": "5.1.1",
   "author": {
@@ -6,0 +6,0 @@ "name": "Jonathan Ong",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

16037

increased by1.82%

Lines of code

190

increased by3.26%

Number of medium maintenance alerts

0

decreased by-100%

No dependency changes