Normalize host path to prevent access to arbitrary paths

2018-06-22 08:29:08 -07:00
parent 24d9d3063b
commit 5ca64dd642
1 changed files with 1 additions and 1 deletions
--- a/src/addons.js
+++ b/src/addons.js
@@ -219,7 +219,7 @@ function getBindsSync(app, addons) {

            for (let mount of addons[addon].bindMounts) {
                let [ host, container ] = mount.split(':');
-                binds.push(path.join(paths.APPS_DATA_DIR, app.id, 'data', host) + ':' + container);
+                binds.push(path.join(paths.APPS_DATA_DIR, app.id, 'data', path.normalize(host)) + ':' + container);
            }
            break;
        default: break;