Windows: Do our file filtration with case-insensitive checks

This commit is contained in:
Scott Nonnenberg 2019-04-10 12:17:40 -07:00
parent 62de2a229d
commit be86169a8a

View file

@ -25,27 +25,35 @@ function _createFileHandler({ userDataPath, installPath, isWindows }) {
return (request, callback) => { return (request, callback) => {
// normalize() is primarily useful here for switching / to \ on windows // normalize() is primarily useful here for switching / to \ on windows
const target = path.normalize(_urlToPath(request.url, { isWindows })); const target = path.normalize(_urlToPath(request.url, { isWindows }));
// here we attempt to follow symlinks to the ultimate final path, reflective of what
// we do in main.js on userDataPath and installPath
const realPath = fs.existsSync(target) ? fs.realpathSync(target) : target; const realPath = fs.existsSync(target) ? fs.realpathSync(target) : target;
// finally we do case-insensitive checks on windows
const properCasing = isWindows ? realPath.toLowerCase() : realPath;
if (!path.isAbsolute(realPath)) { if (!path.isAbsolute(properCasing)) {
console.log( console.log(
`Warning: denying request to non-absolute path '${realPath}'` `Warning: denying request to non-absolute path '${properCasing}'`
); );
return callback(); return callback();
} }
if ( if (
!realPath.startsWith(userDataPath) && !properCasing.startsWith(
!realPath.startsWith(installPath) isWindows ? userDataPath.toLowerCase() : userDataPath
) &&
!properCasing.startsWith(
isWindows ? installPath.toLowerCase() : installPath
)
) { ) {
console.log( console.log(
`Warning: denying request to path '${realPath}' (userDataPath: '${userDataPath}', installPath: '${installPath}')` `Warning: denying request to path '${properCasing}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
); );
return callback(); return callback();
} }
return callback({ return callback({
path: realPath, path: properCasing,
}); });
}; };
} }