Jonathan Kirkwood
3c7094241c
Percent-encoded traversal (..%2f) survived routing and let an unauthenticated request read files outside static/, including the database and session secret on the data volume. Paths are now resolved and contained to the frontend build directory; anything that escapes falls back to index.html.
18 lines
603 B
TypeScript
18 lines
603 B
TypeScript
import { VersionInfo } from '@start9labs/start-sdk'
|
|
|
|
export const v_0_2_41 = VersionInfo.of({
|
|
version: '0.2.41:0',
|
|
releaseNotes: {
|
|
en_US:
|
|
'Security fix: closes an unauthenticated path-traversal flaw in the ' +
|
|
'static file server that let a crafted URL read files outside the web ' +
|
|
'root (including the database and session secret). Requests are now ' +
|
|
'contained to the frontend build directory. Upgrade recommended for all ' +
|
|
'internet-facing deployments.',
|
|
},
|
|
migrations: {
|
|
up: async ({ effects }) => {},
|
|
down: async ({ effects }) => {},
|
|
},
|
|
})
|