3 ms·
change that to: > gsub(/\/\.\.+\/?/, "/", request_filename) # avoid directory traversal source: am "regex expert" >..< (and know how to spell)
by pmarreck 3y ago
change that to:
> gsub(/\/\.\.+\/?/, "/", request_filename) # avoid directory traversal
source: am "regex expert" >..< (and know how to spell)
- hackideiomat 3y agoU sure? echo -e "GET /../.. HTTP/1.0\r\n\r\n" | nc localhost 8888
- pmarreck 3y agoHah. I know the web frameworks have solved this issue but it seems like a fun puzzle to figure out without peeking