3 ms·
Did you test it against relative path(s) ? For example, what if "../" is included in the file path ? It can be used to escape the root folder and traverse arbit
by csunbird 8y ago
Did you test it against relative path(s) ? For example, what if "../" is included in the file path ? It can be used to escape the root folder and traverse arbitrarily in the host file system.
- clusmore 8y agoThat's a great question. Although I don't encourage anybody to expose this to any network they don't trust, it was a concern. I was previously passing the incoming path directly to ServeFile[1] which handles this, although I have since put in a filepath.Clean... I've tested this in browsers and with curl and it looks okay, I'll take a closer look at this though. [1]: https://golang.org/pkg/net/http/#ServeFile https://golang.org/pkg/net/http/#ServeFile