Put double dot check after path construction for extra safety
This commit is contained in:
@@ -61,13 +61,6 @@ namespace Middleware
|
||||
}
|
||||
}
|
||||
|
||||
if (ContainsDoubleDots(request.url.GetPath()))
|
||||
{
|
||||
// We cannot deal with this, we are not going to bother checking if
|
||||
// this double dot escapes our root directory
|
||||
return;
|
||||
}
|
||||
|
||||
std::string path;
|
||||
if (request.url.HasPath())
|
||||
{
|
||||
@@ -79,6 +72,13 @@ namespace Middleware
|
||||
path = root + "/index.html";
|
||||
}
|
||||
|
||||
if (ContainsDoubleDots(request.url.GetPath()))
|
||||
{
|
||||
// We cannot deal with this, we are not going to bother checking if
|
||||
// this double dot escapes our root directory
|
||||
return;
|
||||
}
|
||||
|
||||
if (!TryReadAllBytes(path, response.content))
|
||||
{
|
||||
return;
|
||||
|
||||
Reference in New Issue
Block a user