Impact
fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.
For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.
Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.
Patches
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Workarounds
Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.
References
UlisesGascon Remediation reviewer
mcollina Remediation reviewer
Impact
fast-uri'snormalize()andserialize()apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading..segments and can turn a document-relative reference into a root-relative one.For example,
normalize('a/../b')returns/bandnormalize('../x')returnsx, soresolve(base, normalize(ref))points at a different resource thanresolve(base, ref), andequal()treats distinct references as the same.Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.
Patches
Upgrade to
fast-uri2.4.8,3.1.9, or4.2.3.Workarounds
Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.
References