live-server.js:37 uses path.join(root, req.url) with no sanitization. req to /../../etc/passwd walks right out of the root dir and reads system files
basically anyone who can hit that server can pull any file they want as long as the app process has read permissions
fix: normalize and validate the path, make sure it stays inside the root folder. strip out .. and block absolute paths
live-server.js:37usespath.join(root, req.url)with no sanitization. req to/../../etc/passwdwalks right out of the root dir and reads system filesbasically anyone who can hit that server can pull any file they want as long as the app process has read permissions
fix: normalize and validate the path, make sure it stays inside the root folder. strip out
..and block absolute paths