tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-08-09 11:08:19 +00:00
Code Releases Activity

Fix http path bug (#16117) (#16120)

Browse Source 
* Fix http path bug

* Add missed request

* add tests

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This commit is contained in:
6543
2021-06-09 15:58:00 +02:00
committed by GitHub
parent ce2ade05e6
commit 3be67e9a2b
3 changed files with 131 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
routers/repo/http.go
View File

@@ -447,7 +447,26 @@ func (h *serviceHandler) setHeaderCacheForever() {
h.w.Header().Set("Cache-Control", "public, max-age=31536000")
}
func containsParentDirectorySeparator(v string) bool {
if !strings.Contains(v, "..") {
return false
}
for _, ent := range strings.FieldsFunc(v, isSlashRune) {
if ent == ".." {
return true
}
}
return false
}
func isSlashRune(r rune) bool { return r == '/' || r == '\\' }
func (h *serviceHandler) sendFile(contentType, file string) {
if containsParentDirectorySeparator(file) {
log.Error("request file path contains invalid path: %v", file)
h.w.WriteHeader(http.StatusBadRequest)
return
}
reqFile := path.Join(h.dir, file)
fi, err := os.Stat(reqFile)