Bug Fix: file system traversal bug where %2F is treated as /

Cargo.lock

@@ -186,7 +186,7 @@ dependencies = [
 
 [[package]]
 name = "gemserv"
-version = "0.6.3"
+version = "0.6.4"
 dependencies = [
  "futures-util",
  "log",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gemserv"
-version = "0.6.3"
+version = "0.6.4"
 authors = ["int 80h <int@80h.dev>"]
 edition = "2018"
 description = "A gemini server"

README

@@ -57,7 +57,6 @@ Scripts have 5 seconds to complete or they will be terminated.
 
 ### CGI Environments
 
-
 These variables are preset for you. If you need more you can define them in the
 config file under "cgienv"
 
@@ -77,3 +76,8 @@ TLS variables
  - TLS_CLIENT_HASH
  - REMOTE_USER
 
+## Changelog
+
+### [0.6.4] - 20220202
+
+Fixed a file system traversal bug. All previous versions are unsafe.

src/con_handler.rs

@@ -243,7 +243,7 @@ pub async fn handle_connection(mut con: conn::Connection, url: url::Url) -> Resu
     } else {
         path.push(&con.srv.server.dir);
         if url.path() != "" || url.path() != "/" {
-            let decoded = util::url_decode(url.path().trim_start_matches('/').as_bytes());
+            let decoded = util::url_decode(url.path().as_bytes()).trim_start_matches('/').to_owned();
             path.push(decoded);
         }
     }