server.js: confine static file serving to project root — block path traversal

d957aedddd41d01ed385ae73a467d04b306d6248 · 2026-05-18 20:34:43 -0700 · Steve

Files touched

M server.js

Diff

commit d957aedddd41d01ed385ae73a467d04b306d6248
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 18 20:34:43 2026 -0700

    server.js: confine static file serving to project root — block path traversal
---
 server.js | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/server.js b/server.js
index 8237c85..edf54f8 100644
--- a/server.js
+++ b/server.js
@@ -66,9 +66,18 @@ const server = http.createServer((req, res) => {
 
     // Remove query string parameters from URL
     let requestPath = req.url.split('?')[0];
-    let filePath = '.' + requestPath;
-    if (filePath === './') {
-        filePath = './index.html';
+    try { requestPath = decodeURIComponent(requestPath); } catch (e) { requestPath = requestPath; }
+    if (requestPath === '/') {
+        requestPath = '/index.html';
+    }
+
+    // Confine all file serving to the project root — block path traversal
+    const root = __dirname;
+    const filePath = path.join(root, requestPath);
+    if (filePath !== root && !filePath.startsWith(root + path.sep)) {
+        res.writeHead(403, { 'Content-Type': 'text/html' });
+        res.end('<h1>403 - Forbidden</h1>', 'utf-8');
+        return;
     }
 
     const extname = String(path.extname(filePath)).toLowerCase();

← 0f7f065 Wire the Sort select to actually re-sort the grid (newest/co · back to Flockedwallpaper · Hero search keeps the active sort order applied instead of r 075035f →