zias/wolk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: clean path in patch handler

Browse Source
This commit is contained in:
Henrique Dias
2026-03-14 08:13:51 +01:00
parent c21af0791a
commit 4bd7d69c82
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
http/resource.go
View File

@@ -212,6 +212,8 @@ func resourcePatchHandler(fileCache FileCache) handleFunc {
dst := r.URL.Query().Get("destination") dst := r.URL.Query().Get("destination")
action := r.URL.Query().Get("action") action := r.URL.Query().Get("action")
dst, err := url.QueryUnescape(dst) dst, err := url.QueryUnescape(dst)
dst = path.Clean("/" + dst)
src = path.Clean("/" + src)
if !d.Check(src) || !d.Check(dst) { if !d.Check(src) || !d.Check(dst) {
return http.StatusForbidden, nil return http.StatusForbidden, nil
} }