b8d820fc2a
The StaticFileRouter can access file in the immediate parent directory if the client sends a specially crafted, non RFC conforming HTTP 1.x request. By sending a HTTP request without a "/" predicating the path. The StaticFileRouter fails to detect directory traversal since it checks for "/../" in the path. This PR fixes the issue by detecting if there's potential for directory traversal. If true, we follow the path and detect if it reaches out of the document root at any point. Also added 2 new tests for edge cases in static file serving. (Not related to the bug). Co-authored-by: an-tao <antao2002@gmail.com> Bug discovered by: oToToT <https://github.com/oToToT> |
||
|---|---|---|
| .. | ||
| integration_test | ||
| unittests | ||
| CMakeLists.txt | ||