react-native/local-cli/server/util
Andrew Clark 9862a77b6a Use file name whitelist to prevent RCE
Summary:
Use a whitelist to validate user-provided file names. This doesn't cover the entire range of valid filenames but should cover almost all of them in practice. Allows letters, numbers, periods, dashes, and underscores. Opting to use a whitelist instead of a blacklist because getting this wrong leaves us vulnerable to a RCE attack.

This is the same patch I submitted to create-react-app: https://github.com/facebook/create-react-app/pull/4866

See s163726 for more details

Reviewed By: LukasReschke

Differential Revision: D9504148

fbshipit-source-id: e3c7587f1b7f93bec90a58a38d5f6d58f1f59275
2018-09-04 11:32:51 -07:00
..
debugger-ui Fix future sketchy-null errors after bug fix in '@flow strict' files 2018-08-30 21:01:55 -07:00
external Make copy button work on android emulator in Linux using xsel 2017-04-04 10:20:19 -07:00
copyToClipBoard.js Prettier RN local-cli 2018-05-11 13:00:50 -07:00
jsPackagerClient.js Prettier RN local-cli 2018-05-11 13:00:50 -07:00
launchChrome.js Prettier RN local-cli 2018-05-11 13:00:50 -07:00
launchEditor.js Use file name whitelist to prevent RCE 2018-09-04 11:32:51 -07:00
messageSocket.js Prettier RN local-cli 2018-05-11 13:00:50 -07:00
webSocketProxy.js Prettier RN local-cli 2018-05-11 13:00:50 -07:00