Automattic / Automattic/docspress
Potential false positive path traversal with REST on some hosting providers
- Dominant language
- JavaScript
- Stars
- 27
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
## What is the issue?
For hosting providers that have proactive WAF rules (In this case Pressable), there may be potential issues with relative paths within code examples that are being documented. When transmitted via the pages API code examples with relative `../` are being treated as path traversal exploits in code blocks/examples.
## How to reproduce
Have a plugin that has relative paths within javascript that will be output such as...
```
import { MantlePanels } from '../../slots';
```
## How can you fix / workaround
Wondering if the action that is doing the transmission could log a more robust response when receiving a 406 error and/or potentially provide examples for using @ style aliases within webpack configs
It's a better cleaner practice and may give guidance when onboard if documenting a react heavy project with relative path imports as part of webpack
```
Your webpack.config.js already has a resolve.alias block — currently only pinning date-fns. Adding one for the shared internals:
alias: {
...defaultConfig.resolve?.alias,
'date-fns': path.resolve( __dirname, 'node_modules/date-fns' ),
'@slots': path.resolve( __dirname, './src/slots' ),
},
```
### Other Notes
I am not sure if there is some specific escaping that could be done to help other devs, there is technically a "better way" with aliases. My first test was on an older codebase. This came up in our initial testing of a react UI in the admin and 12 of 25 pages for a plugin did not make it to to docs due to a 406 response from the hosting provider.
I did not confirm if this happens with other coding languages but was able to confirm it with the hosting provider we are using for this test implementation and react.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the action that transmits code examples through the Pages API and reproduce the 406 response using the relative JavaScript import shown. Review webpack.config.js and determine whether the issue belongs in transmission handling or in documentation for an alias workaround; done means the affected examples publish successfully or the documented workaround is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react, wordpress
- Domain
- api, documentation
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100