fix: don't allow direct access to hidden entries on Windows
Massimo Melina committed
Sep 25, 2024 at 16:42 UTC
fa1bd6516524fae5d3c42d62d4d15776f53f715f
2 files changed
+4
package.json
+1
@@ -80,6 +80,7 @@
80
"fs-x-attributes": "^1.0.2",
81
"iconv-lite": "^0.6.3",
82
"ip2location-nodejs": "^9.6.0",
83
+ "is-hidden-file": "^1.1.2",
84
"koa": "^2.13.4",
85
"koa-compress": "^5.1.0",
86
"koa-mount": "^4.0.0",
src/vfs.ts
+3
@@ -14,6 +14,7 @@ import events from './events'
14
import { expandUsername } from './perm'
15
import { getCurrentUsername } from './auth'
16
import { Stats } from 'node:fs'
17
+import { isHiddenFile } from 'is-hidden-file'
18
19
const showHiddenFiles = defineConfig('show_hidden_files', false)
20
@@ -114,6 +115,8 @@ export async function urlToNode(url: string, ctx?: Koa.Context, parent: VfsNode=
115
return urlToNode(rest, ctx, ret, getRest)
116
if (ret.source)
117
try {
118
+ if (IS_WINDOWS && !showHiddenFiles.get() && isHiddenFile(ret.source))
119
+ throw 'hiddenFile'
120
const st = ret.stats || await fs.stat(ret.source) // check existence
121
ret.isFolder = st.isDirectory()
122
}