diff --git a/src/main/modules/static-server.ts b/src/main/modules/static-server.ts index 276af78..d97d041 100644 --- a/src/main/modules/static-server.ts +++ b/src/main/modules/static-server.ts @@ -2,7 +2,7 @@ import { createServer, Server } from 'http'; import { readFile } from 'fs/promises'; import { join } from 'path'; import { lookup } from 'mime-types'; -import { pathExists, sanitizePath } from '@/utils/node/fs'; +import { pathExists } from '@/utils/node/fs'; let server: Server | null = null; let serverPort = 0; @@ -10,16 +10,15 @@ let serverPort = 0; export const startStaticServer = (distPath: string) => new Promise((resolve, reject) => { server = createServer(async (req, res) => { - let filePath = join(distPath, req.url === '/' ? 'index.html' : req.url!); + const requestPath = req.url === '/' ? 'index.html' : req.url!; + let filePath = join(distPath, requestPath); if (!(await pathExists(filePath))) { filePath = join(distPath, 'index.html'); } - const sanitizedFilePath = sanitizePath(filePath); - try { - const content = await readFile(sanitizedFilePath); + const content = await readFile(filePath); const contentType = lookup(filePath) || 'application/octet-stream'; res.writeHead(200, { 'Content-Type': contentType }); diff --git a/src/utils/node/fs.ts b/src/utils/node/fs.ts index 165b7d6..ce8a2ea 100644 --- a/src/utils/node/fs.ts +++ b/src/utils/node/fs.ts @@ -1,26 +1,10 @@ import { readFile, writeFile, access, mkdir } from 'fs/promises'; import { constants } from 'fs'; -import { dirname, normalize } from 'path'; - -// eslint-disable-next-line no-comments/disallowComments -/** - * This function normalizes a file path and checks for null - * bytes to prevent security issues. - * This is probably not relevant for our local desktop app, - * but github does warn about it via "js/path-injection". - */ -export const sanitizePath = (path: string) => { - const normalized = normalize(path); - if (normalized.includes('\0')) { - throw new Error('Invalid path: null byte detected'); - } - return normalized; -}; +import { dirname } from 'path'; export const pathExists = async (path: string) => { - const sanitized = sanitizePath(path); try { - await access(sanitized, constants.F_OK); + await access(path, constants.F_OK); return true; } catch { return false;