Skip to content

Commit

Permalink
Fixes #437 by splitting on both windows and linux slashes when extrac…
Browse files Browse the repository at this point in the history
…ting filenames
  • Loading branch information
eoftedal committed Jun 13, 2024
1 parent 7231dfb commit 568db4f
Show file tree
Hide file tree
Showing 2 changed files with 57 additions and 47 deletions.
2 changes: 1 addition & 1 deletion node/lib/retire.js
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ exports.scanUri = function (uri, repo) {
};

exports.scanFileName = function (fileName, repo) {
var result = scan(fileName, 'filename', repo, splitAndMatchAll('/'));
var result = scan(fileName, 'filename', repo, splitAndMatchAll(/[\/\\]/));
return check(result, repo);
};

Expand Down
102 changes: 56 additions & 46 deletions node/spec/tests/filenamescan.spec.js
Original file line number Diff line number Diff line change
@@ -1,49 +1,59 @@
var fs = require("fs"),
assert = require("../assert"),
retire = require("../../lib/retire");
var fs = require('fs'),
assert = require('../assert'),
retire = require('../../lib/retire');

var data = fs.readFileSync("spec/repository.json");
var data = fs.readFileSync('spec/repository.json');
var repo = JSON.parse(data);

describe("filename scan", function() {
it("should_be_vulnerable_between", function(done) {
var result = retire.scanFileName("jquery-1.8.1.js", repo);
assert.isVulnerable(result);
done();
});
it("should_not_be_vulnerable_before", function(done) {
var result = retire.scanFileName("jquery-1.6.1.js", repo);
assert.isNotVulnerable(result);
done();
});
it("should_not_be_vulnerable_at", function(done) {
var result = retire.scanFileName("jquery-1.9.0.js", repo);
assert.isNotVulnerable(result);
done();
});
it("should_not_be_vulnerable_above", function(done) {
var result = retire.scanFileName("jquery-1.9.1.js", repo);
assert.isNotVulnerable(result);
done();
});
it("should_be_vulnerable_before", function(done) {
var result = retire.scanFileName("jquery-1.4.js", repo);
assert.isVulnerable(result);
done();
});
it("should_not_be_vulnerable_at_final", function(done) {
var result = retire.scanFileName("jquery-1.6.0.js", repo);
assert.isNotVulnerable(result);
done();
});
it("should_be_vulnerable_at_rc", function(done) {
var result = retire.scanFileName("jquery-1.6.0-rc.1.js", repo);
assert.isVulnerable(result);
done();
});
it("should_not_be_vulnerable_at_patched_rc", function(done) {
var result = retire.scanFileName("jquery-1.6.0-rc.1.1.js", repo);
assert.isNotVulnerable(result);
done();
});
});
describe('filename scan', function () {
it('should_be_vulnerable_between', function (done) {
var result = retire.scanFileName('jquery-1.8.1.js', repo);
assert.isVulnerable(result);
done();
});
it('should_not_be_vulnerable_before', function (done) {
var result = retire.scanFileName('jquery-1.6.1.js', repo);
assert.isNotVulnerable(result);
done();
});
it('should_not_be_vulnerable_at', function (done) {
var result = retire.scanFileName('jquery-1.9.0.js', repo);
assert.isNotVulnerable(result);
done();
});
it('should_not_be_vulnerable_above', function (done) {
var result = retire.scanFileName('jquery-1.9.1.js', repo);
assert.isNotVulnerable(result);
done();
});
it('should_be_vulnerable_before', function (done) {
var result = retire.scanFileName('jquery-1.4.js', repo);
assert.isVulnerable(result);
done();
});
it('should_not_be_vulnerable_at_final', function (done) {
var result = retire.scanFileName('jquery-1.6.0.js', repo);
assert.isNotVulnerable(result);
done();
});
it('should_be_vulnerable_at_rc', function (done) {
var result = retire.scanFileName('jquery-1.6.0-rc.1.js', repo);
assert.isVulnerable(result);
done();
});
it('should_not_be_vulnerable_at_patched_rc', function (done) {
var result = retire.scanFileName('jquery-1.6.0-rc.1.1.js', repo);
assert.isNotVulnerable(result);
done();
});
it('should_be_vulnerable_between_linux_path', function (done) {
var result = retire.scanFileName('/usr/file/jquery-1.8.1.js', repo);
assert.isVulnerable(result);
done();
});
it('should_be_vulnerable_between_windows_path', function (done) {
var result = retire.scanFileName('\\usr\\file\\jquery-1.8.1.js', repo);
assert.isVulnerable(result);
done();
});
});

0 comments on commit 568db4f

Please sign in to comment.