LordMZTE
/
vidzig
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: don't allow absolute paths (duh)

This commit is contained in:
LordMZTE 2023-03-22 18:39:04 +01:00
parent 8629c93766
commit b1a847cf2c
Signed by: LordMZTE
GPG Key ID: B64802DC33A64FF6
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/routes.zig
View File

@ -258,7 +258,7 @@ pub fn vidsRoute(
const filepath = try std.fs.path.resolve(std.heap.c_allocator, &.{ state.vids_dir, basepath });
defer std.heap.c_allocator.free(filepath);
if (std.mem.startsWith(u8, filepath, ".."))
if (std.fs.path.isAbsolute(filepath) or std.mem.startsWith(u8, filepath, ".."))
return c.OCS_FORBIDDEN;
const filepath_z = try std.heap.c_allocator.dupeZ(u8, filepath);