Merge pull request #2767 from inkz/patch-1

Update RTEDemoApi.js
epam · Feb 27, 2025 · fe5bbb1 · fe5bbb1
2 parents 5415240 + 69a6b2b
commit fe5bbb1
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/server/api/RTEDemoApi.js b/server/api/RTEDemoApi.js
@@ -6,8 +6,11 @@ const path = require('path');
 const { sortBy } = require('lodash');
 
 router.post('/get-demo-doc-content', (req, res) => {
-    const docContentPath = path.join(__dirname, '../../public/rte_contents/', `${req.body.name}`);
-
+    const contentDir = path.join(__dirname, '../../public/rte_contents/');
+    const docContentPath = path.resolve(contentDir, `${req.body.name}`);
+    if (!docContentPath.startsWith(contentDir)) {
+        res.send(null);
+    }
     if (!fs.existsSync(docContentPath)) {
         res.send(null);
     } else {