From 84164d64e55e6ac15334b17ee96eb648a3768478 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Go=C5=82e=CC=A8biowski-Owczarek?= Date: Sat, 26 Oct 2024 00:35:48 +0200 Subject: [PATCH] Build: Fix an XSS in the test server HTML serving logic The test server has a rule for `/tests/unit/*/*.html` paths that serves a proper local file. However, the parameters after `/unit/` were so far not escaped, leading to possibly reading a file from outside of the Git repository. Fix that by replacing non-alphanumeric characters that are also not `-` or `_`. This should resolve one CodeQL alert. --- tests/runner/createTestServer.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/runner/createTestServer.js b/tests/runner/createTestServer.js index 67770c71d8..6f409bea2f 100644 --- a/tests/runner/createTestServer.js +++ b/tests/runner/createTestServer.js @@ -23,8 +23,9 @@ export async function createTestServer( report ) { // Add a script tag to HTML pages to load the QUnit listeners app.use( /\/tests\/unit\/([^/]+)\/\1\.html$/, async( req, res ) => { + const moduleEscaped = req.params[ 0 ].replace( /[^a-z0-9_-]/gi, "" ); const html = await readFile( - `tests/unit/${ req.params[ 0 ] }/${ req.params[ 0 ] }.html`, + `tests/unit/${ moduleEscaped }/${ moduleEscaped }.html`, "utf8" ); res.send(