Add security cases.

Author: RubenVerborgh

lib/handlers/resource-mapper.js

@@ -17,6 +17,11 @@ class ResourceMapper {
     const urlExtension = /(\.[^/.]+)?$/.exec(pathname)[0]
     const urlPath = pathname.substr(0, pathname.length - urlExtension.length)
 
+    // Sanity checks
+    if (urlPath.indexOf('/..') >= 0) {
+      throw new Error('Disallowed /.. segment in URL')
+    }
+
     // Map to the filename on disk, appending the extension of different from the URL
     const contentType = contentTypes && contentTypes[0] || ''
     const extension = contentType in extensions ? `.${extensions[contentType][0]}` : ''

test/unit/resource-mapper-test.js

@@ -1,5 +1,7 @@
 const ResourceMapper = require('../../lib/handlers/resource-mapper')
-const { expect } = require('chai')
+const chai = require('chai')
+const { expect } = chai
+chai.use(require('chai-as-promised'))
 
 describe('ResourceMapper', () => {
   describe('A ResourceMapper instance for a single-user setup', () => {
@@ -31,12 +33,35 @@ describe('ResourceMapper', () => {
         createIfNotExists: true
       },
       { path: `${rootPath}space/foo.exe$.html` })
+
+    // Security cases
+
+    itMapsUrl(mapper, 'a URL with an unknown content type',
+      {
+        url: 'http://localhost/space/foo.html',
+        contentTypes: ['text/unknown'],
+        createIfNotExists: true
+      },
+      { path: `${rootPath}space/foo.html$` })
+
+    itMapsUrl(mapper, 'a URL with a /.. path segment',
+      {
+        url: 'http://localhost/space/../bar'
+      },
+      new Error('Disallowed /.. segment in URL'))
   })
 })
 
 function itMapsUrl (mapper, label, options, expected) {
-  it(`maps ${label}`, async () => {
-    const actual = await mapper.mapUrlToFile(options)
-    expect(actual).to.deep.equal(expected)
-  })
+  if (!(expected instanceof Error)) {
+    it(`maps ${label}`, async () => {
+      const actual = await mapper.mapUrlToFile(options)
+      expect(actual).to.deep.equal(expected)
+    })
+  } else {
+    it(`does not map ${label}`, async () => {
+      const actual = mapper.mapUrlToFile(options)
+      await expect(actual).to.be.rejectedWith(expected.message)
+    })
+  }
 }