diff options
| author | Lunny Xiao <xiaolunwen@gmail.com> | 2021-06-09 20:53:12 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-06-09 14:53:12 +0200 |
| commit | da057996d584c633524406d69b424cbc3d4473eb (patch) | |
| tree | d8c575f20eca8aec63ee2455458dbdeae76cad2a /routers/web/repo/http.go | |
| parent | 1bfb0a24d843e10d6d95c4319a84980485e584ed (diff) | |
| download | gitea-da057996d584c633524406d69b424cbc3d4473eb.tar.gz gitea-da057996d584c633524406d69b424cbc3d4473eb.zip | |
Fix http path bug (#16117)
* Fix http path bug
* Add missed request
* add tests
Co-authored-by: 6543 <6543@obermui.de>
Diffstat (limited to 'routers/web/repo/http.go')
| -rw-r--r-- | routers/web/repo/http.go | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/routers/web/repo/http.go b/routers/web/repo/http.go index 30d382b8ef..649d6d1eb1 100644 --- a/routers/web/repo/http.go +++ b/routers/web/repo/http.go @@ -366,7 +366,26 @@ func (h *serviceHandler) setHeaderCacheForever() { h.w.Header().Set("Cache-Control", "public, max-age=31536000") } +func containsParentDirectorySeparator(v string) bool { + if !strings.Contains(v, "..") { + return false + } + for _, ent := range strings.FieldsFunc(v, isSlashRune) { + if ent == ".." { + return true + } + } + return false +} + +func isSlashRune(r rune) bool { return r == '/' || r == '\\' } + func (h *serviceHandler) sendFile(contentType, file string) { + if containsParentDirectorySeparator(file) { + log.Error("request file path contains invalid path: %v", file) + h.w.WriteHeader(http.StatusBadRequest) + return + } reqFile := path.Join(h.dir, file) fi, err := os.Stat(reqFile) |