johnpapa / johnpapa/lite-server

Server crashes on directory traversal attempt with invalid UTF-8 character

Open
#82 5 comments 2 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
2.3k
Forks
262
PR merge metrics
No merged PRs in 30d

Description

Server crashes on directory traversal attempt with invalid UTF-8 character

A scheduled scan kicked off on our network and crashed my npm-lite server. Checking the logs, the crash was on a GET for /%80../%80../%80../%80../%80../%80../windows/win.ini

%80 is not a valid URL encoded character under UTF-8, which may be why it crashed.
### Bug repro steps
1. Launch server
2. Attempt to navigate to /%80../%80../%80../%80../%80../%80../windows/win.ini
3. Server crashes
### Environment
- `lite-server` version: 2.2.0
- `nodejs` version: v4.4.5
- `npm` version: 2.15.5
- OS type/version: Win 7 Enterprise 64-bit

Server log:

[1] D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\connect-logger\lib\logger.js:15
[1] format = format.replace(/%url/g, "\x1b[90m" + (decodeURI((url.parse(req.url)).pathname)) + "\x1b[0m");
[1] ^
[1]
[1] URIError: URI malformed
[1] at decodeURI (native)
[1] at parse (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\connect-logger\lib\logger.js:15:52)
[1] at ServerResponse.res.end (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\connect-logger\lib\logger.js:41:17)
[1] at Array.write (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\index.js:137:9)
[1] at listener (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\index.js:169:15)
[1] at onFinish (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\index.js:100:5)
[1] at callback (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\node_modules\ee-first\index.js:55:10)
[1] at IncomingMessage.onevent (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\node_modules\ee-first\index.js:93:5)
[1] at emitNone (events.js:67:13)
[1] at IncomingMessage.emit (events.js:166:7)
[1]

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.