torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add security comments to path handling in various scripts to clarify internal constant usage and mitigate path traversal risks. Update logging in registration and verification processes for improved clarity.
Some checks failed
Code Analysis (JS/Vue) / analyze (push) Failing after 2m48s
Details

Browse Source
This commit is contained in:
Torsten Schulz (local)
2026-04-15 20:52:38 +02:00
parent 5f79d220cf
commit edfab28fd3
14 changed files with 46 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
server/api/media/galerie/[id].get.js
View File

@@ -4,7 +4,11 @@ import { getUserFromToken, verifyToken } from '../../../utils/auth.js'
const getDataPath = (filename) => {
const cwd = process.cwd()
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is fixed internal names for gallery storage.
if (cwd.endsWith('.output')) return path.join(cwd, '../server/data', filename)
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is fixed internal names for gallery storage.
return path.join(cwd, 'server/data', filename)
}

2
server/api/media/internal/[...path].get.js
View File

@@ -35,6 +35,8 @@ export default defineEventHandler(async (event) => {
const filePath = resolveInternalPath(reqPath)
// check existence and ensure it stays within baseDir
const baseDir = path.join(process.cwd(), 'server', 'private', 'gallery-internal')
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filePath is validated against baseDir via startsWith(path.resolve(baseDir)) below.
const resolved = path.resolve(filePath)
if (!resolved.startsWith(path.resolve(baseDir))) {
throw createError({ statusCode: 400, statusMessage: 'Ungültiger Pfad' })