mirror of
https://github.com/affaan-m/ECC.git
synced 2026-09-22 17:45:15 +02:00
pablolozano0216-artandGitHub
8d59727633
The temporary HTTP server that export-pdf.sh spins up to render a deck joined the decoded request path onto SERVE_DIR without checking the resolved path, and listened on all interfaces. A request such as `/..%2f..%2f..%2fetc%2fpasswd` (raw, or issued by a malicious deck via fetch() while it renders) returned files outside the deck directory, and any host on the network could hit the port while an export was running. - resolve the decoded path against SERVE_ROOT and answer 403 when the result is not inside it (handles ../, %2e%2e, %2f and query strings) - answer 400 on malformed percent-encoding instead of throwing - listen on 127.0.0.1 only; the only client is the local headless browser Verified with raw HTTP requests against the handler: `/` and `/index.html` -> 200, `/../x`, `/..%2f..%2fx`, `/%2e%2e/x`, `/deck/../../x` -> 403, unknown file -> 404, `/%zz` -> 400, and server.address() reports 127.0.0.1. Fixes #3101