Critical security vulnerability fix

This commit is contained in:
Matthew Bryant (mandatory) 2021-09-16 21:51:33 -07:00
parent cd319453bc
commit 4f4abf655c

19
app.js
View file

@ -49,6 +49,25 @@ const SCREENSHOT_FILENAME_REGEX = new RegExp(/^[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]
async function get_app_server() {
const app = express();
// I have a question for Express:
// https://youtu.be/ZtjFsQBuJWw?t=4
app.set('case sensitive routing', true);
// Making 100% sure this works like it should
// https://youtu.be/aCbfMkh940Q?t=6
app.use(async function(req, res, next) {
if(req.path.toLowerCase() === req.path) {
next();
}
res.status(401).json({
"success": false,
"error": "No.",
"code": "WHY_ARE_YOU_SHOUTING"
}).end();
});
app.use(bodyParser.json());
// Set security-related headers on requests