From 406fea7b6cfe507d402529e34da3e8cda61877ef Mon Sep 17 00:00:00 2001
From: int 80h <int@80h.dev>
Date: Wed, 2 Feb 2022 18:03:04 -0500
Subject: [PATCH] Bug Fix: file system traversal bug where %2F is treated as /

---
 Cargo.lock         | 2 +-
 Cargo.toml         | 2 +-
 README             | 6 +++++-
 src/con_handler.rs | 2 +-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 549bd50..95770fc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -186,7 +186,7 @@ dependencies = [
 
 [[package]]
 name = "gemserv"
-version = "0.6.3"
+version = "0.6.4"
 dependencies = [
  "futures-util",
  "log",
diff --git a/Cargo.toml b/Cargo.toml
index 83b9d7b..fdc47e2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "gemserv"
-version = "0.6.3"
+version = "0.6.4"
 authors = ["int 80h <int@80h.dev>"]
 edition = "2018"
 description = "A gemini server"
diff --git a/README b/README
index 20588f4..07f6898 100644
--- a/README
+++ b/README
@@ -57,7 +57,6 @@ Scripts have 5 seconds to complete or they will be terminated.
 
 ### CGI Environments
 
-
 These variables are preset for you. If you need more you can define them in the
 config file under "cgienv"
 
@@ -77,3 +76,8 @@ TLS variables
  - TLS_CLIENT_HASH
  - REMOTE_USER
 
+## Changelog
+
+### [0.6.4] - 20220202
+
+Fixed a file system traversal bug. All previous versions are unsafe.
\ No newline at end of file
diff --git a/src/con_handler.rs b/src/con_handler.rs
index 6a11523..33cb604 100644
--- a/src/con_handler.rs
+++ b/src/con_handler.rs
@@ -243,7 +243,7 @@ pub async fn handle_connection(mut con: conn::Connection, url: url::Url) -> Resu
     } else {
         path.push(&con.srv.server.dir);
         if url.path() != "" || url.path() != "/" {
-            let decoded = util::url_decode(url.path().trim_start_matches('/').as_bytes());
+            let decoded = util::url_decode(url.path().as_bytes()).trim_start_matches('/').to_owned();
             path.push(decoded);
         }
     }