mirror of
https://github.com/TryGhost/Ghost.git
synced 2025-01-27 22:49:56 -05:00
3004e03bc6
refs https://github.com/TryGhost/Team/issues/41 - if you send invalid encoded url components in the path, the server tried to decode the url - if it contains invalid characters like /AF%, it throwed a 500 - we return a page not found error instead
59 lines
1.7 KiB
JavaScript
59 lines
1.7 KiB
JavaScript
// # uncapitalise Middleware
|
|
// Usage: uncapitalise(req, res, next)
|
|
// After:
|
|
// Before:
|
|
// App: Admin|Site|API
|
|
//
|
|
// Detect upper case in req.path.
|
|
//
|
|
// Example req:
|
|
// req.originalUrl = /blog/ghost/signin/?asdAD=asdAS
|
|
// req.url = /ghost/signin/?asdAD=asdAS
|
|
// req.baseUrl = /blog
|
|
// req.path = /ghost/signin/
|
|
|
|
var utils = require('../utils'),
|
|
errors = require('../errors'),
|
|
i18n = require('../i18n'),
|
|
uncapitalise;
|
|
|
|
uncapitalise = function uncapitalise(req, res, next) {
|
|
var pathToTest = (req.baseUrl ? req.baseUrl : '') + req.path,
|
|
isSignupOrReset = pathToTest.match(/^(.*\/ghost\/(signup|reset)\/)/i),
|
|
isAPI = pathToTest.match(/^(.*\/ghost\/api\/v[\d\.]+\/.*?\/)/i),
|
|
redirectPath, decodedURI;
|
|
|
|
if (isSignupOrReset) {
|
|
pathToTest = isSignupOrReset[1];
|
|
}
|
|
|
|
// Do not lowercase anything after /api/v0.1/ to protect :key/:slug
|
|
if (isAPI) {
|
|
pathToTest = isAPI[1];
|
|
}
|
|
|
|
try {
|
|
decodedURI = decodeURIComponent(pathToTest);
|
|
} catch (err) {
|
|
return next(new errors.NotFoundError({
|
|
message: i18n.t('errors.errors.pageNotFound'),
|
|
err: err
|
|
}));
|
|
}
|
|
|
|
/**
|
|
* In node < 0.11.1 req.path is not encoded, afterwards, it is always encoded such that | becomes %7C etc.
|
|
* That encoding isn't useful here, as it triggers an extra uncapitalise redirect, so we decode the path first
|
|
*/
|
|
if (/[A-Z]/.test(decodedURI)) {
|
|
redirectPath = (
|
|
utils.removeOpenRedirectFromUrl((req.originalUrl || req.url).replace(pathToTest, pathToTest.toLowerCase()))
|
|
);
|
|
|
|
return utils.url.redirect301(res, redirectPath);
|
|
}
|
|
|
|
next();
|
|
};
|
|
|
|
module.exports = uncapitalise;
|