From 146506a2718c3cd4eda6503d0f33c27e7a5828fb Mon Sep 17 00:00:00 2001
From: Alejandro Romero Herrera <alromh87@gmail.com>
Date: Fri, 4 Sep 2020 21:09:29 +0300
Subject: [PATCH] Fixed path traversal vulnerability when symlinking
 directories

---
 lib/providers/fs.js | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/lib/providers/fs.js b/lib/providers/fs.js
index 232af3c9..2b14b468 100644
--- a/lib/providers/fs.js
+++ b/lib/providers/fs.js
@@ -27,6 +27,20 @@ var multiStat = function(paths) {
   });
 };
 
+var symlinkPath = function(requestedpath, fullpath) {
+  var dirs = requestedpath.split('/');
+  if( dirs.length < 2) return false;
+  var basepath = fullpath.replace(new RegExp(requestedpath+"$"),"");
+  var testpath = basepath;
+  for( var i = 1; i < dirs.length-1; i++ ){
+    testpath = pathjoin(testpath, dirs[i]);
+    var stat = fs.lstatSync(testpath);
+    if( stat.isSymbolicLink() ){
+      return true;
+    }
+  }
+};
+
 module.exports = function(options) {
   var etagCache = {};
   var cwd = options.cwd || process.cwd();
@@ -85,9 +99,13 @@ module.exports = function(options) {
       result.modified = stat.mtime.getTime();
 
       if (!symlink) {
-       // Symlinks removed by default
-       if(stat.isSymb) {
-         return RSVP.reject({code: 'EINVAL'});
+        // Symlinks removed by default
+        if(stat.isSymb) {
+          return RSVP.reject({code: 'EINVAL'});
+        }
+        // If file is not symlink verify its not accessed by symlinked directory
+        if(symlinkPath(pathname, stat.path)) {
+          return RSVP.reject({code: 'EINVAL'});
         }
 
       }