johnpapa / johnpapa/lite-server
Server crashes on directory traversal attempt with invalid UTF-8 character
- Dominant language
- JavaScript
- Stars
- 2.3k
- Forks
- 262
- PR merge metrics
- No merged PRs in 30d
Description
Server crashes on directory traversal attempt with invalid UTF-8 character
A scheduled scan kicked off on our network and crashed my npm-lite server. Checking the logs, the crash was on a GET for /%80../%80../%80../%80../%80../%80../windows/win.ini
%80 is not a valid URL encoded character under UTF-8, which may be why it crashed.
### Bug repro steps
1. Launch server
2. Attempt to navigate to /%80../%80../%80../%80../%80../%80../windows/win.ini
3. Server crashes
### Environment
- `lite-server` version: 2.2.0
- `nodejs` version: v4.4.5
- `npm` version: 2.15.5
- OS type/version: Win 7 Enterprise 64-bit
Server log:
[1] D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\connect-logger\lib\logger.js:15
[1] format = format.replace(/%url/g, "\x1b[90m" + (decodeURI((url.parse(req.url)).pathname)) + "\x1b[0m");
[1] ^
[1]
[1] URIError: URI malformed
[1] at decodeURI (native)
[1] at parse (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\connect-logger\lib\logger.js:15:52)
[1] at ServerResponse.res.end (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\connect-logger\lib\logger.js:41:17)
[1] at Array.write (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\index.js:137:9)
[1] at listener (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\index.js:169:15)
[1] at onFinish (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\index.js:100:5)
[1] at callback (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\node_modules\ee-first\index.js:55:10)
[1] at IncomingMessage.onevent (D:\testAngular\angular2-typescript-quickstart\node_modules\lite-server\node_modules\browser-sync\node_modules\connect\node_modules\finalhandler\node_modules\on-finished\node_modules\ee-first\index.js:93:5)
[1] at emitNone (events.js:67:13)
[1] at IncomingMessage.emit (events.js:166:7)
[1]
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.