ti-nuage/gemserv
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Bug fix: Another traversal bug. This time /..%2F

Browse Source
This commit is contained in:
int 80h
2022-02-09 21:50:18 -05:00
parent 406fea7b6c
commit eb129467f1
4 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Cargo.lock generated
View File

@@ -186,7 +186,7 @@ dependencies = [
[[package]] [[package]]
name = "gemserv" name = "gemserv"
version = "0.6.4" version = "0.6.5"
dependencies = [ dependencies = [
"futures-util", "futures-util",
"log", "log",

2
Cargo.toml
View File

@@ -1,6 +1,6 @@
[package] [package]
name = "gemserv" name = "gemserv"
version = "0.6.4" version = "0.6.5"
authors = ["int 80h <int@80h.dev>"] authors = ["int 80h <int@80h.dev>"]
edition = "2018" edition = "2018"
description = "A gemini server" description = "A gemini server"

4
README
View File

@@ -78,6 +78,10 @@ TLS variables
## Changelog ## Changelog
### [0.6.5] - 20220209
Bug fix: Another traversal bug.
### [0.6.4] - 20220202 ### [0.6.4] - 20220202
Fixed a file system traversal bug. All previous versions are unsafe. Fixed a file system traversal bug. All previous versions are unsafe.

6
src/lib/server.rs
View File

@@ -178,6 +178,12 @@ async fn get_request(mut con: conn::Connection) -> Result<(conn::Connection, url
} }
} }
if request.contains("..") {
logger::logger(con.peer_addr, Status::BadRequest, &request);
con.send_status(Status::BadRequest, None).await?;
return Err(Box::new(GemError("Contained ..".into())));
}
let url = match Url::parse(&request) { let url = match Url::parse(&request) {
Ok(url) => url, Ok(url) => url,
Err(e) => { Err(e) => {