From 1d9c316933b4f1a32d88993d17941353ca2e15e8 Mon Sep 17 00:00:00 2001
From: Jafar Akhondali <jafar.akhoondali@gmail.com>
Date: Fri, 26 Jul 2024 03:43:50 +0200
Subject: [PATCH] Block malicious looking requests to prevent path traversal
 attacks.

---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index 6010ebf..7a61fb1 100644
--- a/server.js
+++ b/server.js
@@ -20,6 +20,11 @@ http.createServer(function (request, response) {
 
     //The requested URL like http://localhost:8000/file.html
     var uri = url.parse(request.url).pathname;
+    if (path.normalize(decodeURI(uri)) !== decodeURI(uri)) {
+        response.statusCode = 403;
+        response.end();
+        return;
+    }
     //get the file.html from above and then find it from the current folder
     var filename = path.join(process.cwd(), uri);