-
Notifications
You must be signed in to change notification settings - Fork 11
fix(): support serve app images #4826
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| import path from "node:path"; | ||
| import { tryServeFiles } from "@next-core/serve-helpers"; | ||
|
|
||
| export default function serveAppImages({ rootDir }, appId) { | ||
| /** | ||
| * @param {import("express").Request} req | ||
| * @param {import("express").Response} res | ||
| */ | ||
| return async function (req, res, next) { | ||
| if (req.method !== "GET") { | ||
| next(); | ||
| return; | ||
| } | ||
|
|
||
| tryServeFiles( | ||
| ["mock-micro-apps", "apps"].map((folder) => | ||
| path.join(rootDir, folder, appId, "dist/images", req.path) | ||
| ), | ||
| req, | ||
| res, | ||
| next | ||
| ); | ||
|
Comment on lines
+15
to
+22
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain验证路径遍历安全性。
运行以下脚本检查 🏁 Script executed: #!/bin/bash
# 查看 tryServeFiles 的完整实现以确认安全性
ast-grep --pattern 'export function tryServeFiles($$$) {
$$$
}'
# 查找是否有路径验证逻辑
rg -nP '(normalize|resolve|relative|\.\./)' packages/serve-helpers/src/ --type=jsLength of output: 1492 Now I need to check the 验证路径遍历安全性 - 确认存在安全漏洞 您的原始评论准确指出了一个实际存在的安全问题。经验证,代码确实存在路径遍历风险: 虽然 Express 的 关键问题是 path.normalize 并非独立的安全解决方案——它可能移除某些冗余路径元素,但不能防止遍历攻击。在此代码中, 建议修复方案: 将规范化路径与硬编码或配置的可信根目录进行比较,若比较失败则表示检测到路径遍历,应拒绝请求。应在 |
||
| }; | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The JSDoc comment is missing the
nextparameter. The returned async function takes three parameters (req, res, next), but the JSDoc only documents two. This should be: