frodovdr/node-red
1
0
Fork 0
mirror of https://github.com/node-red/node-red.git synced 2025-03-01 10:36:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add some extra tests for block/allow

Browse Source 
add micormatch lib to package and extra dummy test file.
add example lines to settings.js
This commit is contained in:
Dave Conway-Jones
2018-12-21 16:25:21 +00:00
parent d1cc3da14d
commit f19025455b
6 changed files with 150 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
packages/node_modules/@node-red/nodes/core/storage/50-file.js vendored
View File

@@ -22,7 +22,7 @@ module.exports = function(RED) {
var path = require("path");
//var udir = path.join(RED.settings.userDir,"**");
var allowlist = [].concat((RED.settings.fileNodeAllowList || ["**"]));
var allowlist = [].concat((RED.settings.fileNodeAllowList || ["/**"]));
var blocklist = [].concat(RED.settings.fileNodeBlockList);
function FileNode(n) {
@@ -40,8 +40,8 @@ module.exports = function(RED) {
function processMsg(msg, done) {
var filename = node.filename || msg.filename || "";
if (filename === "") {
node.warn(RED._("file.errors.nofilename"));
return;
node.error(RED._("file.errors.nofilename",msg));
done();
}
if (filename !== node.lastfile) {
node.lastfile = filename;
@@ -50,19 +50,19 @@ module.exports = function(RED) {
// Always block settings.js
if (filename === path.join(RED.settings.userDir,"settings.js")) {
node.warn(RED._("file.errors.blocked"));
return;
node.error(RED._("file.errors.blocked"),msg);
done();
}
if (mm.any(filename, allowlist, {matchBase:true, dot:true})) {
node.blocked = false;
if (mm.any(filename, blocklist, {matchBase:true, dot:true})) {
node.warn(RED._("file.errors.blocked"));
node.error(RED._("file.errors.blocked"),msg);
node.blocked = true;
return;
done();
}
}
}
if (node.blocked === true) { node.warn(RED._("file.errors.blocked")); return; }
if (node.blocked === true) { node.error(RED._("file.errors.blocked"),msg); done(); }
if ((!node.filename) && (!node.tout)) {
node.tout = setTimeout(function() {
node.status({fill:"grey",shape:"dot",text:filename});
@@ -71,7 +71,7 @@ module.exports = function(RED) {
},333);
}
if (filename === "") {
node.warn(RED._("file.errors.nofilename"));
node.error(RED._("file.errors.nofilename"),msg);
done();
}
else if (node.overwriteFile === "delete") {
@@ -95,7 +95,6 @@ module.exports = function(RED) {
} catch(err) {
node.error(RED._("file.errors.createfail",{error:err.toString()}),msg);
done();
return;
}
}
@@ -119,7 +118,7 @@ module.exports = function(RED) {
done();
});
})
return;
done();
}
else {
// Append mode
@@ -207,9 +206,7 @@ module.exports = function(RED) {
}
catch (e) {
node.msgQueue = [];
if (node.closing) {
closeNode();
}
if (node.closing) { closeNode(); }
throw e;
}
});
@@ -221,9 +218,7 @@ module.exports = function(RED) {
var cb = node.closeCallback;
node.closeCallback = null;
node.closing = false;
if (cb) {
cb();
}
if (cb) { cb(); }
}
this.on('close', function(done) {
@@ -265,28 +260,33 @@ module.exports = function(RED) {
var filename = (node.filename || msg.filename || "").replace(/\t|\r|\n/g,'');
if (filename === "") {
node.warn(RED._("file.errors.nofilename"));
return;
node.error(RED._("file.errors.nofilename"),msg);
done();
}
if (filename !== node.lastfile) {
if (!fs.existsSync(filename)) {
node.error(RED._("file.errors.nofilename"),msg);
return;
}
node.lastfile = filename;
node.blocked = true;
filename = fs.realpathSync(filename);
// Always block settings.js
if (filename === path.join(RED.settings.userDir,"settings.js")) {
node.warn(RED._("file.errors.blocked"));
node.error(RED._("file.errors.blocked"),msg);
return;
}
if (mm.any(filename, allowlist, {matchBase:true, dot:true})) {
node.blocked = false;
if (mm.any(filename, blocklist, {matchBase:true, dot:true})) {
node.warn(RED._("file.errors.blocked"));
node.error(RED._("file.errors.blocked"),msg);
node.blocked = true;
return;
}
}
}
if (node.blocked === true) { node.warn(RED._("file.errors.blocked")); return; }
if (node.blocked === true) { node.error(RED._("file.errors.blocked"),msg); return; }
if (!node.filename) { node.status({fill:"grey",shape:"dot",text:filename}); }
//else {

1
packages/node_modules/@node-red/nodes/package.json vendored
View File

@@ -30,6 +30,7 @@
"is-utf8": "0.2.1",
"js-yaml": "3.12.0",
"media-typer": "1.0.1",
"micromatch": "3.1.10",
"mqtt": "2.18.8",
"multer": "1.4.1",
"mustache": "3.0.1",

6
packages/node_modules/node-red/settings.js vendored
View File

@@ -115,6 +115,12 @@ module.exports = {
// relative to httpRoot
//ui: { path: "ui" },
// Only allow file node to read and write these directories and files
//fileNodeAllowList: [ "/home/nol/**" ],
// Block access to these directories
//fileNodeBlockList: [ __dirname, "/**/etc/**", "/**/.ssh/**" ],
// Securing Node-RED
// -----------------
// To password protect the Node-RED editor and admin API, the following