From b2314e4e65f8f5c367e7eb92f777f4bbf5f1e451 Mon Sep 17 00:00:00 2001 From: Nathaniel Daniel Date: Sat, 28 Jan 2023 15:45:42 -0800 Subject: [PATCH] Add advisory for warp#937 (#1544) * Add advisory for warp#937 * Change date to time of initial report --- crates/warp/RUSTSEC-0000-0000.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 crates/warp/RUSTSEC-0000-0000.md diff --git a/crates/warp/RUSTSEC-0000-0000.md b/crates/warp/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..a3217fa --- /dev/null +++ b/crates/warp/RUSTSEC-0000-0000.md @@ -0,0 +1,24 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "warp" +date = "2022-01-14" +url = "https://github.com/seanmonstar/warp/issues/937" +categories = ["file-disclosure"] +keywords = ["directory traversal", "http"] + +[affected] +os = ["windows"] + +[versions] +patched = [">= 0.3.3"] +``` + +# Improper validation of Windows paths could lead to directory traversal attack + +Path resolution in `warp::filters::fs::dir` didn't correctly validate Windows paths +meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed +and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users +could potentially read files anywhere on the filesystem. + +This only impacts Windows. Linux and other unix likes are not impacted by this.