medium6.5
CVE-2024-34712
Oceanic allows unsanitized user input to lead to path traversal in URLs
Impact
### Impact Input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. ### Workarounds * Sanitizing user input, ensuring strings are valid for the purpose they are being used for. * Encoding input with `encodeURIComponent` before providing it to the library. ### References OceanicJS/Oceanic@8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | oceanic.js | < 1.10.4 | 1.10.4 |