jonathan/Ten31-Portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

0.2.41: contain SPA static serving to the web root

Browse Source 
Percent-encoded traversal (..%2f) survived routing and let an
unauthenticated request read files outside static/, including the
database and session secret on the data volume. Paths are now resolved
and contained to the frontend build directory; anything that escapes
falls back to index.html.
This commit is contained in:
Jonathan Kirkwood
2026-08-10 15:38:21 -05:00
parent 5d4e87e69b
commit 3c7094241c
4 changed files with 104 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/startos/install/versions/index.ts
+3 -2
View File
@@ -1,5 +1,6 @@
export { v_0_2_40 as current } from './v_0_2_40'
export { v_0_2_41 as current } from './v_0_2_41'
import { v_0_1_0 } from './v_0_1_0'
import { v_0_2_40 } from './v_0_2_40'
import { v_0_2_0 } from './v_0_2_0'
import { v_0_2_1 } from './v_0_2_1'
import { v_0_2_3 } from './v_0_2_3'
@@ -39,4 +40,4 @@ import { v_0_2_36 } from './v_0_2_36'
import { v_0_2_37 } from './v_0_2_37'
import { v_0_2_38 } from './v_0_2_38'
import { v_0_2_39 } from './v_0_2_39'
export const other = [v_0_1_0, v_0_2_0, v_0_2_1, v_0_2_3, v_0_2_4, v_0_2_5, v_0_2_6, v_0_2_7, v_0_2_8, v_0_2_9, v_0_2_10, v_0_2_11, v_0_2_12, v_0_2_13, v_0_2_14, v_0_2_15, v_0_2_16, v_0_2_17, v_0_2_18, v_0_2_19, v_0_2_20, v_0_2_21, v_0_2_22, v_0_2_23, v_0_2_24, v_0_2_25, v_0_2_26, v_0_2_27, v_0_2_28, v_0_2_29, v_0_2_30, v_0_2_31, v_0_2_32, v_0_2_33, v_0_2_34, v_0_2_35, v_0_2_36, v_0_2_37, v_0_2_38, v_0_2_39]
export const other = [v_0_1_0, v_0_2_0, v_0_2_1, v_0_2_3, v_0_2_4, v_0_2_5, v_0_2_6, v_0_2_7, v_0_2_8, v_0_2_9, v_0_2_10, v_0_2_11, v_0_2_12, v_0_2_13, v_0_2_14, v_0_2_15, v_0_2_16, v_0_2_17, v_0_2_18, v_0_2_19, v_0_2_20, v_0_2_21, v_0_2_22, v_0_2_23, v_0_2_24, v_0_2_25, v_0_2_26, v_0_2_27, v_0_2_28, v_0_2_29, v_0_2_30, v_0_2_31, v_0_2_32, v_0_2_33, v_0_2_34, v_0_2_35, v_0_2_36, v_0_2_37, v_0_2_38, v_0_2_39, v_0_2_40]
deploy/startos/install/versions/v_0_2_41.ts
+17
View File
@@ -0,0 +1,17 @@
import { VersionInfo } from '@start9labs/start-sdk'
export const v_0_2_41 = VersionInfo.of({
version: '0.2.41:0',
releaseNotes: {
en_US:
'Security fix: closes an unauthenticated path-traversal flaw in the ' +
'static file server that let a crafted URL read files outside the web ' +
'root (including the database and session secret). Requests are now ' +
'contained to the frontend build directory. Upgrade recommended for all ' +
'internet-facing deployments.',
},
migrations: {
up: async ({ effects }) => {},
down: async ({ effects }) => {},
},
})