Node.js leaking path info, how to solve it?

I have a webserver running... and if I curl from another server. Something like that:

curl http://myserver.com/../../../../../etc/rsyslog.conf

then I can see the server info.

Is that a known problem?

UPDATE here is my server code:

app = express.createServer(
            gzip.staticGzip(__dirname + '/public', {maxAge:5000 }),
            express.cookieParser(),
            express.bodyParser()

        );

got a fix like that:

var urlSecurity = function () {
    return function (req, res, next) {
        if (req.url.indexOf('../') >=0) {
            res.send('<div>Server Error</div>' , 500);
        } else if (req.url.indexOf('/..') >=0) {
            res.send('<div>Server Error</div>' , 500);
        } else {
            next();
        }
    }
}
app = express.createServer(
urlSecurity (),
            gzip.staticGzip(__dirname + '/public', {maxAge:5000 }),
            express.cookieParser(),
            express.bodyParser()

        );

is this good enough?

You have a serious security flaw in your program. Fix it immediately.

My best guess from the presented symptom is that you're doing something like:

http.createServer(function (request, response) {
  var file = path.resolve('/path/to/files', request.url)
  fs.createReadStream(file).pipe(response)
})

This is extremely unwise! Always sanitize user input. In this case, it's quite easy:

http.createServer(function (request, response) {
  var requestedFile = path.join('/', request.url);
  var file = path.join('/path/to/files', requestedFile)
  fs.createReadStream(file).pipe(response)
})

So, first we path.join the requested url onto '/'. This will et rid of any .. shenanigans, making it more sanitary. Then, we path.join that onto our url.

Why use path.join rather than path.resolve in this case? Because path.join just joins path parts, rather than resolving them, so a leading / won't have any ill effects.

After the immediate fix, I have done a lot of testing. and I confirm the following:

It is NOT a node problem primarily. It is the gzippo module causing the problem. Gzippo 0.1.3 is causing that problem. 0.1.4 has no problem. NOt sure why is like that. but better not to use the older version of gzippo.