feat: add dashboard interface and quality scripts#10
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| function resolvePath(requestPath) { | ||
| const decodedPath = decodeURIComponent(requestPath.split("?")[0]); | ||
| const relativePath = decodedPath === "/" ? "index.html" : decodedPath.replace(/^\/+/, ""); | ||
| return join(ROOT, relativePath); | ||
| } |
There was a problem hiding this comment.
The path resolution trims only leading slashes (decodedPath.replace(/^\/+/, "")) before joining with the server root. A request such as /../package.json therefore resolves to <root>/../package.json, allowing clients to fetch files outside the intended static directory. Even for a local dev server this exposes arbitrary files on the machine. Normalize the request path (path.resolve) and reject paths that escape the root.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
https://chatgpt.com/codex/tasks/task_b_690262c8b6f88328a71082e135b8e75c