fix(security): better path sanitize on store

zwave-js · Jan 29, 2021 · 9403cb1 · 9403cb1
1 parent e81a24e
commit 9403cb1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app.js b/app.js
@@ -53,7 +53,7 @@ function start (server) {
 
 function sanitizePath (path) {
   // remove every ../
-  path = path.replace(/\.\.\//g, '')
+  path = path.replace(/[.]+\//g, '')
 
   if (!path.startsWith(storeDir)) {
     throw Error('Path not allowed')