api: block more of the local file paths

itteco · Dec 9, 2024 · 3287b6f · 3287b6f
1 parent 6a0a789
commit 3287b6f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/api/views.js b/modules/api/views.js
@@ -107,7 +107,7 @@ function processInitialErrors(uri, next) {
         return true;
     }
 
-    if (/^(https?:\/\/)?\./i.test(uri)) {
+    if (/^(https?:\/\/)?(\.|\/|~)/i.test(uri)) {
         next(new utils.HttpError(400, "file paths are not accepted"));
         return true;
     }