josefandersson/express-formparse

An Express middleware that uses Formidable to parse incoming multi-part forms.

Greetings

I have moved my projects to git.josf.dev.

express-formparse's Issues

If used with bodyParser.urlencoded({extended:true}) file paths may be forged by an attacker

If both multipart and urlencoded types of form are accepted, then an attacker can trick the application use an arbitrary local file instead of the uploaded one.

app.use(bodyParser.urlencoded({ extended: true }));
app.use(formparse.parse());

// Application assumes that 'file' field is an uploaded file:
app.post('/', (req, res) => res.sendFile(req.body.file.path));

However, the file upload can be faked by using bodyParser instead:

curl app -d'file[path]=/etc/hosts' -Hcontent-type:application/x-www-form-urlencoded

I suggest using separate request property for files (e.g. req.files), which isn't shared with other types of parsers.