Block malicious looking requests to prevent path traversal attacks.

Co-Authored-By: Jafar Akhondali <[email protected]>

serve.js

@@ -75,6 +75,11 @@ var http = require("http"),
     };
 
 http.createServer(function(request, response) {
+    if (path.normalize(decodeURI(request.url)) !== decodeURI(request.url)) {
+        response.statusCode = 403;
+        response.end();
+        return;
+    }
 
     var uri = url.parse(request.url).pathname,
         filename = path.join(process.cwd(), uri);