From 90892f0c79d01ee73f71737e5e940b32ab697047 Mon Sep 17 00:00:00 2001
From: Jafar Akhondali <jafar.akhoondali@gmail.com>
Date: Tue, 5 Nov 2024 17:56:50 +0100
Subject: [PATCH] Block malicious looking requests to prevent path traversal
 attacks.

---
 run.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/run.js b/run.js
index 78ad111..af7bc9d 100644
--- a/run.js
+++ b/run.js
@@ -622,6 +622,11 @@ const mimetype = {
 const server = http.createServer(function (request, response) {
     var pathname = url.parse(request.url).pathname;
     var realPath = path.join('./', pathname);
+    if (pathname.includes('..')) {
+        response.writeHead(403);
+        response.end();
+        return;
+    }
     var ext = path.extname(realPath);
     if (!ext) {
         realPath = path.join(realPath, 'index.html');