Check file is not a symlink before returning it

services/clsi/app.coffee

@@ -5,6 +5,7 @@ logger.initialize("clsi")
 smokeTest = require "smoke-test-sharelatex"
 
 Path = require "path"
+fs = require "fs"
 
 Metrics = require "metrics-sharelatex"
 Metrics.initialize("clsi")
@@ -49,9 +50,26 @@ staticServer = express.static Settings.path.compilesDir, setHeaders: (res, path,
 		# that could be used in same-origin/XSS attacks.
 		res.set("Content-Type", "text/plain")
 
+
+
 app.get "/project/:project_id/output/*", (req, res, next) ->
-	req.url = "/#{req.params.project_id}/#{req.params[0]}"
+	basePath = Path.resolve("#{Settings.path.compilesDir}/#{req.params.project_id}")
-	staticServer(req, res, next)
+	path = Path.normalize("#{basePath}/#{req.params[0]}")
+	if path.slice(0, basePath.length) != basePath
+		logger.warn path: req.params[0], project_id: req.params.project_id, "trying to leave project directory, aborting"
+		res.send(404)
+		return
+	fs.lstat path, (error, stats) ->
+		if error?
+			if error.code == "ENOENT"
+				error.statusCode = 404
+			return next(error)
+		if stats.isSymbolicLink()
+			error = new Error("file is a symlink")
+			error.statusCode = 404
+			return next(error)
+		req.url = "/#{req.params.project_id}/#{req.params[0]}"
+		staticServer(req, res, next)
 
 app.get "/status", (req, res, next) ->
 	res.send "CLSI is alive\n"