Skip to content

Commit f2a5564

Browse files
committed
feat: updated dependencies
1 parent b0a796d commit f2a5564

1 file changed

Lines changed: 6 additions & 0 deletions

File tree

src/node/hooks/express/admin.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,12 @@ exports.expressCreateServer = (hookName: string, args: ArgsExpressType, cb: Func
2727
const parsedUrl = url.parse(req.url);
2828
// extract URL path
2929
let pathname = ADMIN_PATH + `${parsedUrl.pathname}`;
30+
pathname = path.normalize(path.join(ADMIN_PATH), parsedUrl.pathname)
31+
32+
if (!pathname.startsWith(ADMIN_PATH)) {
33+
res.statusCode = 403;
34+
return res.end("Forbidden");
35+
}
3036
// based on the URL path, extract the file extension. e.g. .js, .doc, ...
3137
let ext = path.parse(pathname).ext;
3238
// maps file extension to MIME typere

0 commit comments

Comments
 (0)