mirror of
https://github.com/lovasoa/whitebophir
synced 2024-11-14 16:27:13 +00:00
8d71613e6b
The behavior of `Date.parse` is implementation-dependent and hence cannot be relied on for security purposes. In particular, the implementation in Node.js does accept strings such as `../../../etc/foobar-0` as valid (thanks to the trailing digit). The failure to properly validate the filename is not exploitable, as slashes will never be contained in `parts[2]` thanks to the foregoing `split`, but it is probably still better to have a proper validation in place. |
||
|---|---|---|
| .. | ||
| boardData.js | ||
| configuration.js | ||
| createSVG.js | ||
| log.js | ||
| server.js | ||
| sockets.js | ||
| templating.js | ||
| translations.json | ||