Windows: Do our file filtration with case-insensitive checks
This commit is contained in:
parent
62de2a229d
commit
be86169a8a
1 changed files with 14 additions and 6 deletions
|
@ -25,27 +25,35 @@ function _createFileHandler({ userDataPath, installPath, isWindows }) {
|
||||||
return (request, callback) => {
|
return (request, callback) => {
|
||||||
// normalize() is primarily useful here for switching / to \ on windows
|
// normalize() is primarily useful here for switching / to \ on windows
|
||||||
const target = path.normalize(_urlToPath(request.url, { isWindows }));
|
const target = path.normalize(_urlToPath(request.url, { isWindows }));
|
||||||
|
// here we attempt to follow symlinks to the ultimate final path, reflective of what
|
||||||
|
// we do in main.js on userDataPath and installPath
|
||||||
const realPath = fs.existsSync(target) ? fs.realpathSync(target) : target;
|
const realPath = fs.existsSync(target) ? fs.realpathSync(target) : target;
|
||||||
|
// finally we do case-insensitive checks on windows
|
||||||
|
const properCasing = isWindows ? realPath.toLowerCase() : realPath;
|
||||||
|
|
||||||
if (!path.isAbsolute(realPath)) {
|
if (!path.isAbsolute(properCasing)) {
|
||||||
console.log(
|
console.log(
|
||||||
`Warning: denying request to non-absolute path '${realPath}'`
|
`Warning: denying request to non-absolute path '${properCasing}'`
|
||||||
);
|
);
|
||||||
return callback();
|
return callback();
|
||||||
}
|
}
|
||||||
|
|
||||||
if (
|
if (
|
||||||
!realPath.startsWith(userDataPath) &&
|
!properCasing.startsWith(
|
||||||
!realPath.startsWith(installPath)
|
isWindows ? userDataPath.toLowerCase() : userDataPath
|
||||||
|
) &&
|
||||||
|
!properCasing.startsWith(
|
||||||
|
isWindows ? installPath.toLowerCase() : installPath
|
||||||
|
)
|
||||||
) {
|
) {
|
||||||
console.log(
|
console.log(
|
||||||
`Warning: denying request to path '${realPath}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
|
`Warning: denying request to path '${properCasing}' (userDataPath: '${userDataPath}', installPath: '${installPath}')`
|
||||||
);
|
);
|
||||||
return callback();
|
return callback();
|
||||||
}
|
}
|
||||||
|
|
||||||
return callback({
|
return callback({
|
||||||
path: realPath,
|
path: properCasing,
|
||||||
});
|
});
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue