From 6bebed46931cf04dc1d32d5951c8207c6a4cbf41 Mon Sep 17 00:00:00 2001 From: WindLi001 Date: Fri, 10 Feb 2023 21:05:17 +0800 Subject: [PATCH] use Clean() but not Abs() to prevent directory traversal --- api/routes/spa.go | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/api/routes/spa.go b/api/routes/spa.go index 1f1233df..244f85e0 100644 --- a/api/routes/spa.go +++ b/api/routes/spa.go @@ -3,6 +3,7 @@ package routes import ( "net/http" "os" + "path" "path/filepath" ) @@ -27,20 +28,14 @@ func NewSpaHandler(staticPath string, indexPath string) SpaHandler { // file located at the index path on the SPA handler will be served. This // is suitable behavior for serving an SPA (single page application). func (h SpaHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - // get the absolute path to prevent directory traversal - path, err := filepath.Abs(r.URL.Path) - if err != nil { - // if we failed to get the absolute path respond with a 400 bad request - // and stop - http.Error(w, err.Error(), http.StatusBadRequest) - return - } + // get the clean path to prevent directory traversal + servePath := path.Clean(r.URL.Path) // prepend the path with the path to the static directory - path = filepath.Join(h.staticPath, path) + servePath = filepath.Join(h.staticPath, servePath) // check whether a file exists at the given path - _, err = os.Stat(path) + _, err := os.Stat(servePath) if os.IsNotExist(err) { // file does not exist, serve index.html http.ServeFile(w, r, filepath.Join(h.staticPath, h.indexPath))