Disallow upward tree traversal in Windows.

[mbleigh]

Internal bug id: 74001072

[abeisgoat]

This is still being reported as a vulnerability from this report. Anyone know how to mark this as fixed?

[ChALkeR]

@AbeHaskins It is not fixed, a patched version of superstatic was never released. See #255.
I tried pinging them (Google/Firebase) multiple times by side channels, that didn't help.

[ChALkeR]

@AbeHaskins On a personal opinion, I would suggest to switch to some maintained static file server instead of superstatic.

[ChALkeR]

@AbeHaskins Ah, sorry. I was answering from the phone and did not notice that you are a member of @firebase then — I assumed that you were a consumer of superstatic.

So, the answer is — release a fixed version of superstatic and wait for the datasets to be updated.

They do not include a fixed field atm because this was dislosed by @firebase and left for a long time without actual fixed version being released.
E.g. see the discussion at nodejs/security-wg#247 (comment). The normal process includes opening those PRs and landing those entries when an issue is fixed and disclosed or when there is no response from authors, but in this case @firebase disclosed this without releasing a fixed version for a long time, so it was added to the database by Node.js Security WG likewise, after a confirmation from Google that this can be treated as disclosed.

You can also try filing a PR to https://github.com/nodejs/security-wg after releasing the fixed version. That's not the direct location which npm sources their data from, but it's where this vuln entry originates from so other datasets (including npm's one) hopefully would notice the update shortly after.

[ChALkeR]

Also, my note from the original report (I am unsure if it was passed down here):

That fix seems to work, but the recommended solution to prevent path traversal is to resolve the path and then check that the resolved path is inside the base path.

...{some time after}…

Are there plans for implementing the recommended solution of additinally checking the actual resolved path?