Avoid path traversal with "../"-filenames

Author: Sebastian.Just

lib/uploadhandler.js

@@ -174,8 +174,20 @@ module.exports = function (options) {
         var self = this,
             fileName = path.basename(decodeURIComponent(this.req.url));
 
-        fs.unlink(options.uploadDir() + '/' + fileName, function (ex) {
+        var filepath = path.join(options.uploadDir(), fileName);
+        if (filepath.indexOf(options.uploadDir()) !== 0) {
+            self.emit('delete', fileName);
+            self.callback({success: false});            
+            return;
+        }
+        fs.unlink(filepath, function (ex) {
             _.each(options.imageVersions, function (value, version) {
+                var versionfilepath = path.join(options.uploadDir(), version, fileName);
+                if (versionfilepath.indexOf(options.uploadDir()) !== 0) {
+                    self.emit('delete', fileName);
+                    self.callback({success: false});            
+                    return;
+                }
                 fs.unlink(options.uploadDir() + '/' + version + '/' + fileName);
             });
             self.emit('delete', fileName);