GHSA-3p34-w4f6-5xh2 better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

• npm better-helperjs: < 3.0.6 → fixed in 3.0.6

Summary A directory traversal vulnerability exists in the production static file server of `better-helperjs` (`= 3.0.6` Proof of Concept To reproduce this locally on a vulnerable installation: 1. Assume the framework static configuration serves from a `.dist/client` directory. 2. Build the project and create an adjacent prefix secret simulating sensitive deployment structure: ```bash npm run build mkdir -p dist/client-secrets echo "EXPOSED_SECRET" > dist/client-secrets/secret.txt ``` 3. Start the application in Production mode (`NODE_ENV=production tsx server.ts`). 4. Using an HTTP client that doesn't pre-normalize `/../` paths (e.g., `netcat` or raw sockets), send a GET request spanning into the prefix-sharing adjacent folder: ```http GET /%2e%2e%2fclient-secrets/secret.txt HTTP/1.1 Host: localhost:4174 Connection: close ``` 5. The server incorrectly validates the path and responds with `HTTP/1.1 200 OK` exposing `EXPOSED_SECRET`. *(Note: Developer environment `npm run dev` servers are immune as static requests are handled defensively by Vite's Dev Middlewares. This vulnerability only triggers upon `production` starts).* Remediation / Patches The path validation block has been updated to mandate exact path separation bounds by enforcing `path.sep` onto the evaluated traversal string. ```typescript // Enforces separator OR exact root matches preventing prefix extension if (!resolved.startsWith(root + path.sep) && resolved !== root) { return null; } ``` Workarounds If upgrading is temporarily impossible, users can safeguard their environment by ensuring no sensitive directories are deployed adjacent to their static build `client` directories sharing the identical word-prefix string.