zhushenwudi/ew_author
1
0
Fork 0
mirror of https://git.ethanthesleepy.one/ethanaobrien/ew synced 2026-07-12 00:32:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix logic

Browse Source
This commit is contained in:
Ethan O'Brien
2026-06-06 17:00:55 -05:00
parent 154a38a013
commit 29f56a18cb
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/static_handlers.rs
View File

@@ -16,9 +16,13 @@ async fn maintenance(_req: HttpRequest) -> HttpResponse {
fn safe_join(base: &Path, untrusted: &str) -> Option<PathBuf> { fn safe_join(base: &Path, untrusted: &str) -> Option<PathBuf> {
let relative = untrusted.trim_start_matches("/"); let relative = untrusted.trim_start_matches("/");
let joined = base.join(relative); if Path::new(relative)
let canonical = joined.canonicalize().ok()?; .components()
canonical.starts_with(base.canonicalize().ok()?).then_some(canonical) .any(|c| matches!(c, std::path::Component::ParentDir))
{
return None;
}
Some(base.join(relative))
} }
#[cfg(feature = "library")] #[cfg(feature = "library")]