aboutsummaryrefslogtreecommitdiffstats
path: root/tests
diff options
context:
space:
mode:
authorMichał Gołębiowski-Owczarek <m.goleb@gmail.com>2024-10-28 16:47:29 +0100
committerGitHub <noreply@github.com>2024-10-28 16:47:29 +0100
commit85bed8ddd893390fd41bd7e93d2a44a1b5d9b885 (patch)
tree025040a0e3d592dddfb9ca65208c6e65edea2eb7 /tests
parentaf8adca5481d0ac5db0865032b6c4c7e21421be7 (diff)
downloadjquery-ui-85bed8ddd893390fd41bd7e93d2a44a1b5d9b885.tar.gz
jquery-ui-85bed8ddd893390fd41bd7e93d2a44a1b5d9b885.zip
Build: Fix an XSS in the test server HTML serving logic
The test server has a rule for `/tests/unit/*/*.html` paths that serves a proper local file. However, the parameters after `/unit/` so far accepted many characters that have special meaning, leading to possibly reading a file from outside of the Git repository. Fix that by only accepting alphanumeric characters, `-` or `_`. This should resolve one CodeQL alert. Closes gh-2309
Diffstat (limited to 'tests')
-rw-r--r--tests/runner/createTestServer.js2
1 files changed, 1 insertions, 1 deletions
diff --git a/tests/runner/createTestServer.js b/tests/runner/createTestServer.js
index 67770c71d..875e6d3b1 100644
--- a/tests/runner/createTestServer.js
+++ b/tests/runner/createTestServer.js
@@ -22,7 +22,7 @@ export async function createTestServer( report ) {
} );
// Add a script tag to HTML pages to load the QUnit listeners
- app.use( /\/tests\/unit\/([^/]+)\/\1\.html$/, async( req, res ) => {
+ app.use( /\/tests\/unit\/([a-zA-Z0-9_-]+)\/\1\.html$/, async( req, res ) => {
const html = await readFile(
`tests/unit/${ req.params[ 0 ] }/${ req.params[ 0 ] }.html`,
"utf8"