fix: prevent upload bypass via uppercase path

NGPixel · web-flow · commit 7b14b39de087 · 2022-01-29T18:45:51.000-05:00
diff --git a/server/helpers/security.js b/server/helpers/security.js
@@ -32,7 +32,7 @@ module.exports = {
         token = req.cookies['jwt']
       }
       // Force uploads to use Auth headers
-      if (req.path === '/u') {
+      if (req.path.toLowerCase() === '/u') {
         return null
       }
       return token

Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ module.exports = {`
`32`	`32`	`token = req.cookies['jwt']`
`33`	`33`	`}`
`34`	`34`	`// Force uploads to use Auth headers`
`35`		`- if (req.path === '/u') {`
	`35`	`+ if (req.path.toLowerCase() === '/u') {`
`36`	`36`	`return null`
`37`	`37`	`}`
`38`	`38`	`return token`