Security Fix for Directory Traversal - huntr.dev - #2

https://huntr.dev/app/users/Mik317 has fixed the Directory Traversal vulnerability 🔨. Mik317 has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
GitHub Issue URL | #1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/node-asset-cache/1/README.md

User Comments:

📊 Metadata *

Please enter the direct URL for this bounty on huntr.dev. This is compulsory and will help us process your bounty submission quicker.

Bounty URL: https://www.huntr.dev/app/bounties/open/1-npm-node-asset-cache

⚙️ Description *

The fix has been applied to avoid path traversal issues, and checks if there are .. sequences + normalizes the path provided in order to avoid file fetching by other resources.

💻 Technical Description *

The fix is made through the checkFile function, which checks the paths in 2 ways:

1. path.normalize makes possible avoid most of the cases
2. file.replace('..', '') avoids eventual bypasses working in win with other syntaxes like ../\ or ..\\, deleting all the double dots to prevent the dir escalation.

🐛 Proof of Concept (PoC) *

1. Download the library in the folder
2. Make the server.js file:

var pkg = require('./node-asset-cache')
pkg.listen(9000,function(){})

3. node server.js
4. In another terminal execute curl http://localhost:9000/test/../../../../../../../../../../../etc/passwd --path-as-is
   

🔥 Proof of Fix (PoF) *

Same steps above with the fixed version:

👍 User Acceptance Testing (UAT)

All works correctly