Major - P3 | Insufficient input validation | While ExportDataTool validates input for the path traversal characters it is not sufficient enough since it does not do normalization of unicode encoding. |
The export code which does validateExportName decode filename from URI, the filename is constructed from collection name and database which can be unicode, so even though code checks for path traversal in ..,
, / , it may miss validation if unicode chars were used.
Params: * Collection
- Database|Medium|Input Validation|Implement a more robust strategy for path validation:
- normalize('NFKC')
- format check using regexp - safePathRegex = /^[a-zA-Z0-9-_\.\/]+$/;
- Resolve path and validate location
- const intendedPath = path.resolve(baseDir, normalizedPath);
Verify the final path hasn't escaped the base intendedPath.startsWith(baseDir)|