From 856d9a4b97a56f1964d8ff75564361c503a10b24 Mon Sep 17 00:00:00 2001
From: "kritik.b" <kritik.b@media.net>
Date: Thu, 16 Apr 2026 08:35:21 +0530
Subject: [PATCH] fix(docker-server): reject null bytes in resolvePath

Defensively harden the path traversal guard by returning null
early when the URL contains a null byte, before normalization runs.

Made-with: Cursor
---
 docker-server.mjs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docker-server.mjs b/docker-server.mjs
index bcc1c8636..87b53c7d1 100644
--- a/docker-server.mjs
+++ b/docker-server.mjs
@@ -21,6 +21,7 @@ const contentTypes = {
 };
 
 function resolvePath(urlPath) {
+  if (urlPath.includes('\0')) return null;
   const cleanPath = normalize(decodeURIComponent(urlPath).replace(/^\/+/, ''));
   const candidate = join(root, cleanPath);
   if (!candidate.startsWith(root)) return null;