GHSA-5h5v-hw44-f6gg
Oceanic allows unsanitized user input to lead to path traversal in URLs
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | oceanic.js | < 1.10.4 | 1.10.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban.
### Workarounds
* Sanitizing user input, ensuring strings are valid for the purpose they are being used for.
* Encoding input with `encodeURIComponent` before providing it to the library.
### References
OceanicJS/Oceanic@8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe
References
External links from the advisory. They lead to third-party sites.