Disallow upward tree traversal in Windows.

lib/providers/fs.js

@@ -68,7 +68,7 @@ module.exports = function(options) {
   return function(req, pathname) {
     pathname = decodeURI(pathname);
     // jumping to parent directories is not allowed
-    if (pathname.indexOf('../') >= 0) {
+    if (pathname.indexOf('../') >= 0 || pathname.indexOf('..\\') >= 0 || pathname.toLowerCase().indexOf('..%5c') >= 0) {
       return RSVP.resolve(null);
     }
 

test/unit/providers/fs.spec.js

@@ -44,6 +44,18 @@ describe('provider: fs', function() {
     });
   });
 
+  it('should return null if ../', function() {
+    return expect(fsp(opts)({}, '/../b/b.html')).to.eventually.be.null;
+  });
+
+  it('should return null if ..\\', function() {
+    return expect(fsp(opts)({}, '/..\\b\\b.html')).to.eventually.be.null;
+  });
+
+  it('should return null if ..%5c', function() {
+    return expect(fsp(opts)({}, '/..%5Cb%5cb.html')).to.eventually.be.null;
+  });
+
   it('should return null for a file that does not exist', function() {
     return expect(fsp(opts)({}, '/bogus.html')).to.eventually.be.null;
   });

test/unit/providers/memory.spec.js

@@ -27,7 +27,7 @@ describe('memory provider', function() {
 
   it('should return a stream of the content if found', function(done) {
     store['/index.html'] = 'foobar';
-    return provider({}, '/index.html').then(function(result) {
+    provider({}, '/index.html').then(function(result) {
       var out = '';
       result.stream.on('data', function(data) {
         out += data;