From db557e0b6901347a6c6e9f0c614639fd906c3472 Mon Sep 17 00:00:00 2001
From: Evan Simkowitz <esimkowitz@users.noreply.github.com>
Date: Fri, 26 Apr 2024 11:23:09 -0700
Subject: [PATCH] Validate config dir path to resolve security warning (#611)

* Attempt to validate config path to resolve security warning

* move above fullpath

* make sure path does not reference parent dir
---
 wavesrv/cmd/main-server.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/wavesrv/cmd/main-server.go b/wavesrv/cmd/main-server.go
index ef07a022..d1b60815 100644
--- a/wavesrv/cmd/main-server.go
+++ b/wavesrv/cmd/main-server.go
@@ -1018,6 +1018,11 @@ func doShutdown(reason string) {
 
 func configDirHandler(w http.ResponseWriter, r *http.Request) {
 	configPath := r.URL.Path
+	if !fs.ValidPath(configPath) && !strings.Contains(configPath, "..") {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(fmt.Sprintf("invalid path: %s", configPath)))
+		return
+	}
 	configFullPath := path.Join(scbase.GetWaveHomeDir(), configPath)
 	dirFile, err := os.Open(configFullPath)
 	if err != nil {