{"action":"created","issue":{"url":"https://api.github.com/repos/emberjs/data/issues/3971","labels_url":"https://api.github.com/repos/emberjs/data/issues/3971/labels{/name}","comments_url":"https://api.github.com/repos/emberjs/data/issues/3971/comments","events_url":"https://api.github.com/repos/emberjs/data/issues/3971/events","html_url":"https://github.com/emberjs/data/issues/3971","id":120700206,"number":3971,"title":"Too easy to introduce path traversal weaknesses.","user":{"login":"nathanhammond","id":20542,"avatar_url":"https://avatars.githubusercontent.com/u/20542?v=3","gravatar_id":"","url":"https://api.github.com/users/nathanhammond","html_url":"https://github.com/nathanhammond","followers_url":"https://api.github.com/users/nathanhammond/followers","following_url":"https://api.github.com/users/nathanhammond/following{/other_user}","gists_url":"https://api.github.com/users/nathanhammond/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanhammond/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanhammond/subscriptions","organizations_url":"https://api.github.com/users/nathanhammond/orgs","repos_url":"https://api.github.com/users/nathanhammond/repos","events_url":"https://api.github.com/users/nathanhammond/events{/privacy}","received_events_url":"https://api.github.com/users/nathanhammond/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-07T05:06:36Z","updated_at":"2015-12-07T13:26:12Z","closed_at":null,"body":"I'm presenting this as an issue to discuss possible solutions. In an Ember Data Adapter you can specify the URL at which that resource should be addressed. Inside of Ember Data itself there is the [Build URL Mixin](https://github.com/emberjs/data/blob/v2.2.1/packages/ember-data/lib/adapters/build-url-mixin.js) which handles this for you based upon the default patterns.\r\n\r\nThis gives lots of extension points and makes it simple to specify how to accomplish each of the datastore's methods. However, there is one catch: once you specify one of these methods, *you must ensure the URL you generate is safe from path traversal*.\r\n\r\nWhat is path traversal? If you generate a URL like this:\r\n```javascript\r\nreturn `/this/is/${ID}/`;\r\n```\r\nYou have accidentally inserted a path traversal vulnerability if `ID` is:\r\n```javascript\r\n\"../../somewhere/else#\"\r\n```\r\n\r\nNow a cleverly crafted input would be able to load any arbitrary URL via an Ajax request within the same domain. If paired with a JSONP endpoint or an uploaded file or a redirector this is a method to easily end up with an XSS vulnerability.\r\n\r\nThe solution to this problem is actually as simple as calling `encodeURIComponent` [as is done in the default implementation](https://github.com/emberjs/data/blob/v2.2.1/packages/ember-data/lib/adapters/build-url-mixin.js#L97), but it's really easy to forget, as evidenced by [being omitted from Ember Data](https://github.com/emberjs/data/commit/3681fcf463204bfc0acf307cbe8ff0aa4e95efb9) for the first few years of its existence and in applications I've reviewed.\r\n\r\nIn sticking with our premise of API design being a feature (or in this case, I'd call it a bug) I'm filing this issue. Any thoughts?"},"comment":{"url":"https://api.github.com/repos/emberjs/data/issues/comments/162523431","html_url":"https://github.com/emberjs/data/issues/3971#issuecomment-162523431","issue_url":"https://api.github.com/repos/emberjs/data/issues/3971","id":162523431,"user":{"login":"stefanpenner","id":1377,"avatar_url":"https://avatars.githubusercontent.com/u/1377?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanpenner","html_url":"https://github.com/stefanpenner","followers_url":"https://api.github.com/users/stefanpenner/followers","following_url":"https://api.github.com/users/stefanpenner/following{/other_user}","gists_url":"https://api.github.com/users/stefanpenner/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanpenner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanpenner/subscriptions","organizations_url":"https://api.github.com/users/stefanpenner/orgs","repos_url":"https://api.github.com/users/stefanpenner/repos","events_url":"https://api.github.com/users/stefanpenner/events{/privacy}","received_events_url":"https://api.github.com/users/stefanpenner/received_events","type":"User","site_admin":false},"created_at":"2015-12-07T13:26:12Z","updated_at":"2015-12-07T13:26:12Z","body":"I believe this maybe should have been raised via: http://emberjs.com/security/"}}