HIGH

GHSA-8v4j-7jgf-5rg9

Warp vulnerable to Path Traversal via Improper validation of Windows paths

Details

Path resolution in `warp::filters::fs::dir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/warp

Introduced in: 0Fixed in: 0.3.3

Upgrade warp to 0.3.3 or newer (ecosystem crates.io).

References

https://github.com/seanmonstar/warp/issues/937[WEB]
https://github.com/seanmonstar/warp/pull/997[WEB]
https://github.com/seanmonstar/warp/commit/0074a0a3e98786509259bfe3821d3b3f094257aa[WEB]
https://github.com/seanmonstar/warp[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2022-0082.html[WEB]