From 98a5b89982b38e79db684177cf94730ce7fc7aed Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 19 Jan 2015 23:40:02 -0500
Subject: [PATCH] Fix root path disclosure

fixes #70
---
 History.md   |  5 +++++
 index.js     | 10 +++++-----
 test/send.js | 11 +++++++++++
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 13eb276..adf5f6b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix `root` path disclosure
+
 0.11.0 / 2015-01-05
 ===================
 
diff --git a/index.js b/index.js
index 64b6d64..f63081d 100644
--- a/index.js
+++ b/index.js
@@ -415,16 +415,16 @@ SendStream.prototype.pipe = function(res){
 
   var parts
   if (root !== null) {
-    // join / normalize from optional root dir
-    path = normalize(join(root, path))
-    root = normalize(root + sep)
-
     // malicious path
-    if ((path + sep).substr(0, root.length) !== root) {
+    if (upPathRegexp.test(normalize('.' + sep + path))) {
       debug('malicious path "%s"', path)
       return this.error(403)
     }
 
+    // join / normalize from optional root dir
+    path = normalize(join(root, path))
+    root = normalize(root + sep)
+
     // explode path parts
     parts = path.substr(root.length).split(sep)
   } else {
diff --git a/test/send.js b/test/send.js
index 2961c38..0ed4682 100644
--- a/test/send.js
+++ b/test/send.js
@@ -1170,6 +1170,17 @@ describe('send(file, options)', function(){
         .get('/../name.dir/name.txt')
         .expect(403, done)
       })
+
+      it('should not allow root path disclosure', function(done){
+        var app = http.createServer(function(req, res){
+          send(req, req.url, {root: __dirname + '/fixtures'})
+          .pipe(res);
+        });
+
+        request(app)
+        .get('/pets/../../fixtures/name.txt')
+        .expect(403, done)
+      })
     })
 
     describe('when missing', function(){