27281661377

Committed 10 Jun 2026 02:00PM UTC coverage: 95.943% (+0.02%) from 95.927%

Build # 27281661377

Build Type

push

github

Committed by

web-flow

Commit Message

fix: harden folder storage path containment against prefix confusion (#102)

The containment check used `finalPath.startsWith(directoryPath)` with no
trailing separator, so a sibling directory sharing the prefix passed it —
e.g. "/data/contents-evil".startsWith("/data/contents") is true. With
disablePrefixHash an id like "../<root>-evil/x" could therefore escape the
storage root for read/write/delete.

Compare against `directoryPath + path.sep` (allowing the directory itself)
so sibling-prefix paths are rejected. Adds traversal tests.

Also document that the gzip-derived FileInfo.contentSize comes from the
attacker-controllable gzip trailer and must not be trusted for allocation
or size limits.

Coverage Stats

106 of 119 branches covered (89.08%)

Branch coverage included in aggregate %.

367 of 374 relevant lines covered (98.13%)

34.67 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.53

/src/folder-based-storage-component.ts

Build SHA Not Found

The commit SHA "9493a32608a91a6a8b6122a16bb3764803b4206c" was not found in your repository, so the file cannot be loaded. This may be because you posted from a local development environment, or your CI created an ephemeral commit.

decentraland / catalyst-storage / 27281661377

Source File Press 'n' to go to next uncovered line, 'b' for previous

Build SHA Not Found

Source File
Press 'n' to go to next uncovered line, 'b' for previous