Fix returning 403 Forbidden on Windows #6109

Author: Unitech

CHANGELOG.md

@@ -1,4 +1,11 @@
 
+## 7.0.2
+
+### Bug Fixes
+
+- Fix `pm2 serve` returning 403 Forbidden on Windows — traversal guard used hardcoded `/` separator #6109
+
+
 ## 7.0.1
 
 ### Bug Fixes

lib/API/Serve.js

@@ -250,11 +250,13 @@ http.createServer(function (request, response) {
 function serveFile(uri, request, response) {
   var file = decodeURIComponent(new URL(uri || request.url, 'http://localhost').pathname);
 
-  var filePath = path.resolve(options.path + file);
+  var rootPath = path.resolve(options.path);
+  var filePath = path.resolve(rootPath + file);
 
   // since we call filesystem directly so we need to verify that the
   // url doesn't go outside the serve path
-  if (filePath !== options.path && !filePath.startsWith(options.path + '/')) {
+  var relative = path.relative(rootPath, filePath);
+  if (relative !== '' && (relative.startsWith('..') || path.isAbsolute(relative))) {
     response.writeHead(403, { 'Content-Type': 'text/html' });
     return response.end('403 Forbidden');
   }