[Discussion] Contrast reports path traversal vulnerability about i18n-node HOT 4 CLOSED

Thanks for pointing. If you have any further details to share or even a POC, please send them by email before disclosing.
Meanwhile I'll test for traversal vulnerability by myself.

from i18n-node.

So far I was not able to escape from the locales directory. Any provided locale (be it from accept-header, cookie, query parameter or code) has to match to one of configured locales, ie.:

const i18n = new I18n({
  locales: ['en', 'de'],
  directory: './translations'
})

The first locale will act as default for any "unknown" or manipulated locale. Thus, providing a locale like '../en' or '../de' or '../../' will result in using 'en' with reading/writing the file ./translations/en.json relative to process.env.PWD

Even without explicit config, i18n uses 'en' as default locale and 'locales' as default directory. Example:

const i18n = new I18n({})

can only use ./locales/en.json for any given locale.

I am about to add another test as prove for those cases. And I think there is still room for improving parameter sanitizing and filesystem operations in general.

from i18n-node.

@mashpie the tests on my side followed the same logic as yours and I was not able to escape from the locales directory as well. I think it is safe to assume its a false positive. Thanks for the fast response, btw :D

from i18n-node.

@francislz Thanks for your effort, I am glad to hear that. Let's keep this issue open for me to further improve sanitizing.

from i18n-node.