Discord.js: guild.createEmoji() reads from filesystem (but who needs this?)

[ghost]

Please describe the problem you are having in as much detail as possible:
guild.createEmoji() function resolves strings to filesystem paths and reads the image.
This doesn't work with non images.. but it does work for images and adds them as an emote.

Include a reproducible code sample here, if possible:

const Discord = require('discord.js');
const client = new Discord.Client();

function add(msg) {
    const name = msg.content.split(' ')[2];
    const imageURI = msg.content.split(' ')[3];
    if (name && imageURI) {
        msg.guild
            .createEmoji(imageURI, name, null, `created by ${msg.author.id}`)
            .then((emoji) => msg.reply(`${emoji.toString()} added!`))
            .catch((err) => msg.reply(err.message));
    } else {
        msg.reply('Name or image not specified.');
    }
}

function handleMessage(msg, clientId) {
    const splitMessage = msg.content.split(' ');
    if (msg.mentions.users.has(clientId)) {
        if (splitMessage[1] === 'add') {
            add(msg);
            return;
        }
    }
}

client.on('message', (msg) => {
    handleMessage(msg, client.user.id);
});

client.login(process.env.DISCORD_TOKEN);

add the bot to a channel, then do @bot add anything ../path/to/image

Further details:

• discord.js version:
• Node.js version: 8.10
• Operating system: Ubuntu 18.04.1 LTS 4.15.0-45
• Priority this issue should have – please be realistic and elaborate if possible: medium

• [x] I have also tested the issue on latest master, commit hash:

[iCrawl]

Are you saying this is a vulnerability?

[ghost]

You can read any 'image' that is resolvable by the lib and visible to the user running the bot on the target system, so in a way...
Near useless though, and it's a quick fix to just remove the fs parse from DataResolver

[devsnek]

try {
  const u = new URL(imageURI); // throws for relative urls like "../image.png"
  if (u.protocol === 'file:') {
    throw new Error(); // throw for absolute file: url
  }
} catch {
  return message.channel.send('please put a valid url thx');
}

[amishshah]

As @devsnek suggested above you should sanitise this yourself.