api: block local file paths

itteco · Dec 9, 2024 · 6a0a789 · 6a0a789
1 parent a47ca6f
commit 6a0a789
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/modules/api/views.js b/modules/api/views.js
@@ -106,6 +106,11 @@ function processInitialErrors(uri, next) {
         next(new utils.HttpError(400, "local domains not supported"));
         return true;
     }
+
+    if (/^(https?:\/\/)?\./i.test(uri)) {
+        next(new utils.HttpError(400, "file paths are not accepted"));
+        return true;
+    }
 }
 
 export default function(app) {