From a93e065e54092666d46ed2bcf593ce50f2537008 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adil=20Burak=20=C5=9Een?= <56400880+adilburaksen@users.noreply.github.com> Date: Mon, 18 May 2026 08:42:05 -0700 Subject: [PATCH] fix: prevent path traversal in sourceMapViewer /file endpoint Closes https://github.com/dart-lang/sdk/pull/63389 GitOrigin-RevId: 882cfd8dcdbd2d615bd0f7da40d3d83105924fbc Change-Id: If510820433729765a09c9784f0364bbb52e703c8 Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/504020 Reviewed-by: Nate Biggs Commit-Queue: Nate Biggs --- tools/dart2js/sourceMapViewer/bin/source_map_viewer.dart | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tools/dart2js/sourceMapViewer/bin/source_map_viewer.dart b/tools/dart2js/sourceMapViewer/bin/source_map_viewer.dart index b7b26b30137..91572f61fc3 100644 --- a/tools/dart2js/sourceMapViewer/bin/source_map_viewer.dart +++ b/tools/dart2js/sourceMapViewer/bin/source_map_viewer.dart @@ -46,6 +46,15 @@ void handleFile(HttpRequest request) { return; } + // Prevent path traversal and absolute path injection. + // Source references in source maps are relative to the map file; there is + // no legitimate reason for a /file request to escape the map's directory. + if (path.contains('..') || path.startsWith('/') || path.startsWith('file:')) { + request.response.statusCode = HttpStatus.FORBIDDEN; + request.response.close(); + return; + } + Uri uri = sourceMapFile.resolve(path); new File.fromUri(uri) .openRead()