diff options
| author | Lia Lenckowski <lialenck@protonmail.com> | 2023-10-04 12:59:07 +0200 |
|---|---|---|
| committer | metamuffin <metamuffin@disroot.org> | 2023-10-04 14:26:52 +0200 |
| commit | bcea5ff43869296ade7b8eece91da371f9675771 (patch) | |
| tree | ddaba8184e2b596653985110e95d50d157d2e4a8 /src/files.rs | |
| parent | 03ede96a06262aa1fa647f4d26a1a517c33c2103 (diff) | |
| download | gnix-bcea5ff43869296ade7b8eece91da371f9675771.tar gnix-bcea5ff43869296ade7b8eece91da371f9675771.tar.bz2 gnix-bcea5ff43869296ade7b8eece91da371f9675771.tar.zst | |
path resolution (hopefully without path traversal!)
Signed-off-by: metamuffin <metamuffin@disroot.org>
Diffstat (limited to 'src/files.rs')
| -rw-r--r-- | src/files.rs | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/src/files.rs b/src/files.rs index 2ba9a9f..68a3807 100644 --- a/src/files.rs +++ b/src/files.rs @@ -27,12 +27,24 @@ pub async fn serve_files( let rpath = req.uri().path(); let mut path = config.root.clone(); + let mut user_path_depth = 0; for seg in rpath.split("/") { let seg = percent_decode_str(seg).decode_utf8()?; - if seg == "" || seg == ".." { - continue; // not ideal + + if seg == "" || seg == "." { + continue; + } + + if seg == ".." { + if user_path_depth <= 0 { + return Err(ServiceError::BadPath); + } + path.pop(); + user_path_depth -= 1; + } else { + path.push(seg.as_ref()); + user_path_depth += 1; } - path.push(seg.as_ref()) } if !path.exists() { return Err(ServiceError::NotFound); |