require()的不安全加載(LFI 風險)

Description

A security vulnerability exists in Sea.js due to insecure usage of require() for loading external modules. If the module path is influenced by user input, it could potentially allow Local File Inclusion (LFI) or other unauthorized file access.

Affected Version

Sea.js vX.X.X (and possibly earlier versions)

Steps to Reproduce

1. An attacker can manipulate the input to the require() function, which is used to dynamically load modules.
2. If the input is not validated, the attacker can control the module path, potentially loading unauthorized files.

Impact

This issue could allow an attacker to include arbitrary files from the system, leading to information disclosure or code execution in some cases.

Suggested Fix

• Use a strict allowlist for module paths in require().
• Avoid dynamically constructing module paths based on user input.