3 ms·
For irony sake one may link this file as https://github.com/fuchsia-mirror/docs/blob/master/the-book/../../master/the-book/dotdot.md
by mattigames 8y ago
For irony sake one may link this file as
https://github.com/fuchsia-mirror/docs/blob/master/the-book/../../master/the-book/dotdot.md
- Someone1234 8y agoNot as ironic as you'd think considering the article specifically talks about support for .. in userland tooling and uses CWD as an example.
- kiriakasis 8y agowell actually the article complains about stuff like https://github.com/fuchsia-mirror/../internal-page/secret-report/ https://github.com/fuchsia-mirror/../internal-page/secret-re... which quite more serious
- Retr0spectrum 8y agoNope, that actually 404's. It may appear to work, because most browsers will apply some equivalent to the `__fdio_cleanpath()` function mentioned in the article, resolving the traversal locally. You can verify this as follows: curl -I --path-as-is 'https://github.com/fuchsia-mirror/docs/blob/master/the-book/../../master/the-book/dotdot.md'
- mattigames 8y agoif most browsers apply it... doesn't that means it works? Maybe not in the resolved-by-the-server-returning-a-304 sense but in at least some sense.