diff --git a/Cargo.lock b/Cargo.lock index 95770fc..56c2a42 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -186,7 +186,7 @@ dependencies = [ [[package]] name = "gemserv" -version = "0.6.4" +version = "0.6.5" dependencies = [ "futures-util", "log", diff --git a/Cargo.toml b/Cargo.toml index fdc47e2..df4579c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "gemserv" -version = "0.6.4" +version = "0.6.5" authors = ["int 80h "] edition = "2018" description = "A gemini server" diff --git a/README b/README index 07f6898..b6aa1d0 100644 --- a/README +++ b/README @@ -78,6 +78,10 @@ TLS variables ## Changelog +### [0.6.5] - 20220209 + +Bug fix: Another traversal bug. + ### [0.6.4] - 20220202 -Fixed a file system traversal bug. All previous versions are unsafe. \ No newline at end of file +Fixed a file system traversal bug. All previous versions are unsafe. diff --git a/src/lib/server.rs b/src/lib/server.rs index 855613b..25b9579 100644 --- a/src/lib/server.rs +++ b/src/lib/server.rs @@ -177,6 +177,12 @@ async fn get_request(mut con: conn::Connection) -> Result<(conn::Connection, url request.pop(); } } + + if request.contains("..") { + logger::logger(con.peer_addr, Status::BadRequest, &request); + con.send_status(Status::BadRequest, None).await?; + return Err(Box::new(GemError("Contained ..".into()))); + } let url = match Url::parse(&request) { Ok(url) => url,