Bug fix: Another traversal bug. This time /..%2F

Cargo.lock

@@ -186,7 +186,7 @@ dependencies = [
 
 [[package]]
 name = "gemserv"
-version = "0.6.4"
+version = "0.6.5"
 dependencies = [
  "futures-util",
  "log",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gemserv"
-version = "0.6.4"
+version = "0.6.5"
 authors = ["int 80h <int@80h.dev>"]
 edition = "2018"
 description = "A gemini server"

README

@@ -78,6 +78,10 @@ TLS variables
 
 ## Changelog
 
+### [0.6.5] - 20220209
+
+Bug fix: Another traversal bug.
+
 ### [0.6.4] - 20220202
 
 Fixed a file system traversal bug. All previous versions are unsafe.

src/lib/server.rs

@@ -178,6 +178,12 @@ async fn get_request(mut con: conn::Connection) -> Result<(conn::Connection, url
         }
     }
     
+    if request.contains("..") {
+        logger::logger(con.peer_addr, Status::BadRequest, &request);
+        con.send_status(Status::BadRequest, None).await?;
+        return Err(Box::new(GemError("Contained ..".into())));
+    }
+
     let url = match Url::parse(&request) {
         Ok(url) => url,
         Err(e) => {