Fix dashboard static path traversal containment

Author: fallintoplace

packages/apm-contributor-dashboard/.apm/extensions/issue-monitor/server-handler.mjs

@@ -7,7 +7,7 @@
 //   const server = createServer(handler);
 
 import { readFileSync } from "node:fs";
-import { join, resolve, normalize } from "node:path";
+import { isAbsolute, join, normalize, relative, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { parsePanelReview, extractFollowUpItems } from "./logic.mjs";
 
@@ -456,8 +456,10 @@ export function createHandler(deps) {
                 res.end("Not found");
             }
         } else if (urlPath.startsWith("/assets/")) {
-            const resolved = resolve(distDir, normalize(urlPath.slice(1)));
-            if (!resolved.startsWith(resolve(distDir))) {
+            const root = resolve(distDir);
+            const resolved = resolve(root, normalize(urlPath.slice(1)));
+            const rel = relative(root, resolved);
+            if (rel.startsWith("..") || isAbsolute(rel)) {
                 res.writeHead(403); res.end("Forbidden"); return;
             }
             serveStatic(res, resolved);

packages/apm-contributor-dashboard/tests/server.test.mjs

@@ -6,7 +6,7 @@ import { describe, it, before, after, beforeEach } from "node:test";
 import assert from "node:assert/strict";
 import { createServer } from "node:http";
 import { createHandler } from "../.apm/extensions/issue-monitor/server-handler.mjs";
-import { join, dirname } from "node:path";
+import { basename, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const __dir = dirname(fileURLToPath(import.meta.url));
@@ -617,4 +617,21 @@ describe("Path traversal protection", () => {
         const res = await fetch(`${baseUrl}/assets/nonexistent.js`);
         assert.equal(res.status, 404);
     });
+
+    it("blocks sibling prefix traversal to dist-evil paths", async () => {
+        const evilPath = `/assets/../../${basename(DIST_DIR)}-evil/secret.txt`;
+        const url = new URL(`${baseUrl}${evilPath}`);
+        const http = await import("node:http");
+        const res = await new Promise((resolve) => {
+            const req = http.request({
+                hostname: url.hostname,
+                port: url.port,
+                path: evilPath,
+                method: "GET",
+            }, resolve);
+            req.end();
+        });
+
+        assert.equal(res.statusCode, 403);
+    });
 });