diff --git a/lib/providers/fs.js b/lib/providers/fs.js index 232af3c9..2b14b468 100644 --- a/lib/providers/fs.js +++ b/lib/providers/fs.js @@ -27,6 +27,20 @@ var multiStat = function(paths) { }); }; +var symlinkPath = function(requestedpath, fullpath) { + var dirs = requestedpath.split('/'); + if( dirs.length < 2) return false; + var basepath = fullpath.replace(new RegExp(requestedpath+"$"),""); + var testpath = basepath; + for( var i = 1; i < dirs.length-1; i++ ){ + testpath = pathjoin(testpath, dirs[i]); + var stat = fs.lstatSync(testpath); + if( stat.isSymbolicLink() ){ + return true; + } + } +}; + module.exports = function(options) { var etagCache = {}; var cwd = options.cwd || process.cwd(); @@ -85,9 +99,13 @@ module.exports = function(options) { result.modified = stat.mtime.getTime(); if (!symlink) { - // Symlinks removed by default - if(stat.isSymb) { - return RSVP.reject({code: 'EINVAL'}); + // Symlinks removed by default + if(stat.isSymb) { + return RSVP.reject({code: 'EINVAL'}); + } + // If file is not symlink verify its not accessed by symlinked directory + if(symlinkPath(pathname, stat.path)) { + return RSVP.reject({code: 'EINVAL'}); } }