commit 2f0f3d4
la_ninpre
·
2026-01-28 08:30:03 +0000 UTC
parent f7073bf
static files: allow files in a subdirectory allowing '/' in paths is a bit scary, but replacing the check with reject on '..' seems to work. please correct me if i'm wrong and this is insecure.
M
data.c
+1,
-1
1@@ -2691,7 +2691,7 @@ static int _load_raw_file(const char *fn, xs_val **data, int *size,
2 xs_str *_static_fn(snac *snac, const char *id)
3 /* gets the filename for a static file */
4 {
5- if (strchr(id, '/'))
6+ if (strstr(id, ".."))
7 return NULL;
8 else
9 return xs_fmt("%s/static/%s", snac->basedir, id);
M
html.c
+1,
-1
1@@ -5026,7 +5026,7 @@ int html_get_handler(const xs_dict *req, const char *q_path,
2 }
3 else
4 if (xs_startswith(p_path, "s/")) { /** a static file **/
5- xs *l = xs_split(p_path, "/");
6+ xs *l = xs_split_n(p_path, "/", 1);
7 const char *id = xs_list_get(l, 1);
8 int sz;
9