Guard static server against path traversal escaping web root

d6eed7052f2d38518d0d59faa92c50cd184e4c70 · 2026-05-18 20:06:22 -0700 · SteveStudio2

Files touched

M server.js

Diff

commit d6eed7052f2d38518d0d59faa92c50cd184e4c70
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 18 20:06:22 2026 -0700

    Guard static server against path traversal escaping web root
---
 server.js | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 70be76c..dd699b3 100644
--- a/server.js
+++ b/server.js
@@ -31,8 +31,22 @@ const server = http.createServer((req, res) => {
     // Remove query string if present
     filePath = filePath.split('?')[0];
 
-    // Construct full file path
-    filePath = path.join(__dirname, filePath);
+    // Decode percent-encoding so encoded traversal sequences are caught
+    try {
+        filePath = decodeURIComponent(filePath);
+    } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'text/html' });
+        res.end('<h1>400 - Bad Request</h1>', 'utf-8');
+        return;
+    }
+
+    // Construct full file path and confirm it stays inside the web root
+    filePath = path.join(__dirname, path.normalize(filePath));
+    if (filePath !== __dirname && !filePath.startsWith(__dirname + path.sep)) {
+        res.writeHead(403, { 'Content-Type': 'text/html' });
+        res.end('<h1>403 - Forbidden</h1>', 'utf-8');
+        return;
+    }
 
     // Get file extension
     const extname = String(path.extname(filePath)).toLowerCase();

← 89629ef Add noreferrer to all external target=_blank links · back to Billy Website · Add null guards to nav DOM lookups in main.js 9938119 →