Fixed path traversal vulnerability when symlinking directories

lib/providers/fs.js

@@ -27,6 +27,20 @@ var multiStat = function(paths) {
   });
 };
 
+var symlinkPath = function(requestedpath, fullpath) {
+  var dirs = requestedpath.split('/');
+  if( dirs.length < 2) return false;
+  var basepath = fullpath.replace(new RegExp(requestedpath+"$"),"");
+  var testpath = basepath;
+  for( var i = 1; i < dirs.length-1; i++ ){
+    testpath = pathjoin(testpath, dirs[i]);
+    var stat = fs.lstatSync(testpath);
+    if( stat.isSymbolicLink() ){
+      return true;
+    }
+  }
+};
+
 module.exports = function(options) {
   var etagCache = {};
   var cwd = options.cwd || process.cwd();
@@ -85,9 +99,13 @@ module.exports = function(options) {
       result.modified = stat.mtime.getTime();
 
       if (!symlink) {
-       // Symlinks removed by default
-       if(stat.isSymb) {
-         return RSVP.reject({code: 'EINVAL'});
+        // Symlinks removed by default
+        if(stat.isSymb) {
+          return RSVP.reject({code: 'EINVAL'});
+        }
+        // If file is not symlink verify its not accessed by symlinked directory
+        if(symlinkPath(pathname, stat.path)) {
+          return RSVP.reject({code: 'EINVAL'});
         }
 
       }