st - npm Package Compare versions

Comparing version 0.2.5 to 0.2.6

package.json

 {
   "name": "st",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "A module for serving static files.  Does etags, caching, etc.",
@@ -5,0 +5,0 @@ "main": "st.js",

README.md

@@ -237,1 +237,15 @@ # st
 and such, but serve stylus files as css, for example.
+
+## Security Status
+
+Versions prior to 0.2.5 did not properly prevent folder traversal.
+Literal dots in a path were resolved out, but url encoded dots were
+not.  Thus, a request like
+`/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd` would leak sensitive
+data from the server.
+
+As of version 0.2.5, any `'/../'` in the request path, urlencoded or
+not, will be replaced with `'/'`.  If your application depends on url
+traversal, then you are encouraged to please refactor so that you do
+not depend on having `..` in url paths, as this tends to expose data
+that you may be surprised to be exposing.

st.js

@@ -164,4 +164,4 @@ module.exports = st
   p = p.replace(/%5c/ig, '\\')
-  p = p.replace(/^[\/\\]?/, '/')
-  p = p.replace(/[\/\\]\.\.[\/\\]/, '/')
+  p = p.replace(/^[\/\\]?/g, '/')
+  p = p.replace(/[\/\\]\.\.[\/\\]/g, '/')
 
@@ -168,0 +168,0 @@ u = path.normalize(p).replace(/\\/g, '/')

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

45100

increased by1.34%

Number of lines in readme file

251

increased by5.91%

No dependency changes