Implement traversal of folders

index.js

@@ -1,4 +1,22 @@
+/*
+POST request contains a JSON object
+{
+    "loc": <path>
+}
+Reply format
+{
+    "loc": <path>,
+    "back": <path to return to>
+    "contents":[
+        {
+            "name": <file name>,
+            "path": <path>
+            "isDir": <true|false>
+        }
+    ]
+}
 
+*/
 
 
 const express = require('express')
@@ -16,19 +34,35 @@ const DIR=settings.dirname;
 app.use(bodyParser.urlencoded({extended:false}))
 app.use(bodyParser.json())
 
-//Get the status of the folder and things related
-app.get('/files',(req,res,next)=>{
-    fs.readdir(DIR,{withFileTypes:true},(err,stream)=>{
-        if(err){
-            next(err)
-        }
-        else{
-            //res.json(stream[0].isDirectory())
-            res.json({"filename":`${DIR}`,"loc":processing.dirprocess(stream,settings)});
-        }
-    })
-})
+let inDir = (dircheck,dirmain) => !path.relative(path.normalize(dircheck), dirmain).startsWith('..')
 
+//Get folder details
+
+app.post('/files/ls',(req,res,next)=>{
+    const location = processing.mergedir(req.body.loc,settings)
+    //console.log(path.relative( path.normalize(settings.dirname) ,location))
+
+    //Make sure not escaping the given path; insecure
+    if(inDir(settings.dirname,location)){
+        fs.readdir(location,{withFileTypes:true},(err,files)=>{
+            if(err){
+                next(err)
+            }
+            else{
+                res.json({
+                    "location": location ,
+                    "back": inDir(settings.dirname, path.normalize(path.join(location,'..')) )?path.normalize(path.join(location,'..')):null,
+                    "contents":processing.dirprocess(files,location,settings)
+                })
+            }
+        })
+    }
+    else{
+        res.json({"error":"Access denied","loc":'/'})
+    }
+    
+    //next()
+})
 
 //Attempt to upload a file - Placeholder
 app.put('/files/upload',(req,res)=>{
@@ -36,27 +70,10 @@ app.put('/files/upload',(req,res)=>{
     res.json({'error':500})
 })
 
-
-//Get folder details
-app.post('/files/ls',(req,res,next)=>{
-    const location = processing.mergedir(req.body.loc,settings)
-    fs.readdir(location,{withFileTypes:true},(err,files)=>{
-        if(err){
-            next(err)
-        }
-        else{
-            res.json({
-                "location": location ,
-                "contents":processing.dirprocess(files,settings)
-            })
-        }
-    })
-    
-    //next()
-})
-//console.log(path.join(__dirname ,'node_modules','jquery','dist'))
+// Use jquery
 app.use('/jquery', express.static( path.join(__dirname ,'node_modules','jquery','dist') ) )
 
+// Use the statics
 app.get( '/*', express.static( path.join(__dirname,'static') ) )