Put double dot check after path construction for extra safety

This commit is contained in:
2019-06-15 21:10:01 +02:00
parent 95636a2189
commit 9e99dc104f

View File

@@ -61,13 +61,6 @@ namespace Middleware
}
}
if (ContainsDoubleDots(request.url.GetPath()))
{
// We cannot deal with this, we are not going to bother checking if
// this double dot escapes our root directory
return;
}
std::string path;
if (request.url.HasPath())
{
@@ -79,6 +72,13 @@ namespace Middleware
path = root + "/index.html";
}
if (ContainsDoubleDots(request.url.GetPath()))
{
// We cannot deal with this, we are not going to bother checking if
// this double dot escapes our root directory
return;
}
if (!TryReadAllBytes(path, response.content))
{
return;