TK-10575 P1: decode %2f before INTERNAL_STATIC guard (malformed-%-safe) — closes admin-shell disclosure. Carries already-committed TK-10561 contractor widget + TK-10535 asset_class=commercial to prod.

8bbf02bd165165f6262e91327eb58dcc8c15aef4 · 2026-08-18 11:46:25 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 8bbf02bd165165f6262e91327eb58dcc8c15aef4
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Aug 18 11:46:25 2026 -0700

    TK-10575 P1: decode %2f before INTERNAL_STATIC guard (malformed-%-safe) — closes admin-shell disclosure. Carries already-committed TK-10561 contractor widget + TK-10535 asset_class=commercial to prod.
---
 server.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index b9095f0e..71088446 100644
--- a/server.js
+++ b/server.js
@@ -2822,7 +2822,10 @@ require('./src/pr')(app, { adminOnly, sendPage, PUB });
 const INTERNAL_STATIC = /^\/(desk(\.html)?$|desk-assets\/|desk-admin|audience\.html|admin(\/|$|\.html)|versions(\/|$)|consulting(\/|$)|press(\/|$)|social(\.html)?$|summit-leads(\.html)?$|la-commercial(\.html)?$|pulse(\.html)?$|sector(\.html)?$|hub(\.html)?$|brief(\.html)?$|allstar(\.html)?$)/i;
 app.use((req, res, next) => {
   if (req.role === 'admin') return next();
-  if (INTERNAL_STATIC.test(req.path)) {
+  // Decode %2f etc. so an encoded-slash deep-link can't slip past the guard (TK-10575 P1);
+  // guard decodeURIComponent against malformed %-sequences so a bad path can't 500 the request.
+  let _p = req.path; try { _p = decodeURIComponent(req.path); } catch { _p = req.path; }
+  if (INTERNAL_STATIC.test(_p)) {
     // Mirror adminOnly: an anonymous browser deep-link to an internal shell (e.g.
     // /consulting/slideshow, which never reaches the adminOnly route gate) is bounced to
     // /login?next=… so admins can actually sign in and land on the page. APIs, logged-in

← 883bbcf1 auto-data-snapshot: 2026-08-18T11:17:58 (7 data files) — dat · back to Rentv · auto-data-snapshot: 2026-08-18T11:49:58 (7 data files) — dat bee8f412 →