mirror of
https://github.com/projectdiscovery/nuclei
synced 2026-06-08 16:50:47 +00:00
Dwi Siswanto
6f2ade6a9b
* fix(js): respect `allow-local-file-access` in `require` The goja `require() `function used the default host filesystem loader which let JavaScript templates import any local files even when `allow-local-file-access` was disabled. Pooled runtimes kept `require()` state around so a module loaded during a privileged execution could remain cached for a later restricted one. Rebuild the require registry per execution after setting the execution context, and route file- backed module loads to preserve native modules while enforcing the same sandbox rules (as `nuclei/fs`). Signed-off-by: Dwi Siswanto <git@dw1.io> * fix: cross-platform sandbox path checks Replace lexical prefix checks in the template file sandbox with a shared path containment helper that canonicalizes both paths before comparing them to prevent false rejections when the configured templates directory and the resolved file path differ only due to symlink expansion on macOS or path normalization on Windows. Apply the helper in `protocolstate.NormalizePath()` and `Options.GetValidAbsPath()` so JS `require()`- based module loads and helper file resolution use the same rules. Signed-off-by: Dwi Siswanto <git@dw1.io> --------- Signed-off-by: Dwi Siswanto <git@dw1.io>
11 lines
516 B
Go
11 lines
516 B
Go
// Package filepathutil provides utilities for safe filepath operations,
|
|
// particularly for sandboxing file access in template environments.
|
|
//
|
|
// It includes functions to check if a path is contained within a directory,
|
|
// with proper canonicalization to handle symlinks and platform-specific
|
|
// path differences (such as case sensitivity on Windows).
|
|
//
|
|
// TODO(dwisiswant0): This package should be moved to the
|
|
// [github.com/projectdiscovery/utils/filepath], but let see how it goes first.
|
|
package filepathutil
|