From 29f56a18cbdbebd1549670f6d3c8a6c73d97f0df Mon Sep 17 00:00:00 2001
From: Ethan O'Brien <ethan.a.obrien@gmail.com>
Date: Sat, 6 Jun 2026 17:00:55 -0500
Subject: [PATCH] Fix logic

---
 src/static_handlers.rs | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/static_handlers.rs b/src/static_handlers.rs
index 4c97070..493d523 100644
--- a/src/static_handlers.rs
+++ b/src/static_handlers.rs
@@ -16,9 +16,13 @@ async fn maintenance(_req: HttpRequest) -> HttpResponse {
 
 fn safe_join(base: &Path, untrusted: &str) -> Option<PathBuf> {
     let relative = untrusted.trim_start_matches("/");
-    let joined = base.join(relative);
-    let canonical = joined.canonicalize().ok()?;
-    canonical.starts_with(base.canonicalize().ok()?).then_some(canonical)
+    if Path::new(relative)
+        .components()
+        .any(|c| matches!(c, std::path::Component::ParentDir))
+    {
+        return None;
+    }
+    Some(base.join(relative))
 }
 
 #[cfg(feature = "library")]