Add failing tests

Author: timokoessler

library/sources/Express.tests.ts

@@ -74,6 +74,7 @@ export function createExpressTests(expressPackageName: string) {
   });
 
   const express = require(expressPackageName) as typeof import("express");
+  const { readFile } = require("fs") as typeof import("fs");
 
   function getApp(userMiddleware = true) {
     const app = express();
@@ -741,4 +742,29 @@ export function createExpressTests(expressPackageName: string) {
     t.same(blockedResponse.statusCode, 403);
     t.same(blockedResponse.text, "You are blocked by Zen.");
   });
+
+  t.test("it detects path traversal with double encoding", async (t) => {
+    const app = express();
+
+    app.get("/search", (req, res) => {
+      const searchTerm = req.query.q;
+      const fileUrl = new URL(`file:///public/${searchTerm}`);
+
+      readFile(fileUrl, "utf-8", (err, data) => {
+        if (err) {
+          return res.status(500).send("Error reading file");
+        }
+        res.send(`File content of /public/${searchTerm} : ${data}`);
+      });
+    });
+
+    const blockedResponse = await request(app).get(
+      "/search?q=.%252E/etc/passwd"
+    );
+    t.same(blockedResponse.statusCode, 500);
+    t.match(
+      blockedResponse.text,
+      /Error: Zen has blocked a path traversal attack: fs.readFile\(\.\.\.\) originating from query/
+    );
+  });
 }

library/sources/HTTPServer.test.ts

@@ -788,3 +788,45 @@ t.test("it blocks path traversal in path", async (t) => {
     });
   });
 });
+
+t.test("it blocks double encoded path traversal", async (t) => {
+  const server = http.createServer((req, res) => {
+    try {
+      const url = new URL(req.url!, `http://${req.headers.host}`);
+      const filePath = url.searchParams.get("path");
+      const fileUrl = new URL(`file:///public/${filePath}`);
+      const file = readFileSync(fileUrl);
+
+      res.statusCode = 200;
+      res.end(file);
+    } catch (error) {
+      res.statusCode = 500;
+      if (error instanceof Error) {
+        res.end(error.message);
+        return;
+      }
+      res.end("Internal server error");
+    }
+  });
+
+  await new Promise<void>((resolve) => {
+    server.listen(3327, async () => {
+      fetch({
+        url: new URL("http://localhost:3327/?path=.%252E/etc/passwd"),
+        method: "GET",
+        headers: {
+          "x-forwarded-for": "1.2.3.4",
+        },
+        timeoutInMS: 500,
+      }).then(({ statusCode, body }) => {
+        t.equal(statusCode, 500);
+        t.equal(
+          body,
+          "Zen has blocked a path traversal attack: fs.readFileSync(...) originating from query"
+        );
+        server.close();
+        resolve();
+      });
+    });
+  });
+});