diff options
| author | Michał Gołębiowski-Owczarek <m.goleb@gmail.com> | 2024-10-28 16:47:29 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-10-28 16:47:29 +0100 |
| commit | 85bed8ddd893390fd41bd7e93d2a44a1b5d9b885 (patch) | |
| tree | 025040a0e3d592dddfb9ca65208c6e65edea2eb7 | |
| parent | af8adca5481d0ac5db0865032b6c4c7e21421be7 (diff) | |
| download | jquery-ui-85bed8ddd893390fd41bd7e93d2a44a1b5d9b885.tar.gz jquery-ui-85bed8ddd893390fd41bd7e93d2a44a1b5d9b885.zip | |
Build: Fix an XSS in the test server HTML serving logic
The test server has a rule for `/tests/unit/*/*.html` paths that serves
a proper local file. However, the parameters after `/unit/` so far accepted
many characters that have special meaning, leading to possibly reading a file
from outside of the Git repository. Fix that by only accepting alphanumeric
characters, `-` or `_`.
This should resolve one CodeQL alert.
Closes gh-2309
| -rw-r--r-- | tests/runner/createTestServer.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tests/runner/createTestServer.js b/tests/runner/createTestServer.js index 67770c71d..875e6d3b1 100644 --- a/tests/runner/createTestServer.js +++ b/tests/runner/createTestServer.js @@ -22,7 +22,7 @@ export async function createTestServer( report ) { } ); // Add a script tag to HTML pages to load the QUnit listeners - app.use( /\/tests\/unit\/([^/]+)\/\1\.html$/, async( req, res ) => { + app.use( /\/tests\/unit\/([a-zA-Z0-9_-]+)\/\1\.html$/, async( req, res ) => { const html = await readFile( `tests/unit/${ req.params[ 0 ] }/${ req.params[ 0 ] }.html`, "utf8" |