diff options
Diffstat (limited to 'src/cowboy_static.erl')
-rw-r--r-- | src/cowboy_static.erl | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/src/cowboy_static.erl b/src/cowboy_static.erl index c771771..d13db62 100644 --- a/src/cowboy_static.erl +++ b/src/cowboy_static.erl @@ -81,15 +81,32 @@ init_dir(Req, Path, Extra) when is_list(Path) -> init_dir(Req, Path, Extra) -> Dir = fullpath(filename:absname(Path)), PathInfo = cowboy_req:path_info(Req), - Filepath = filename:join([Dir|PathInfo]), + Filepath = filename:join([Dir|[escape_reserved(P, <<>>) || P <- PathInfo]]), Len = byte_size(Dir), case fullpath(Filepath) of << Dir:Len/binary, $/, _/binary >> -> init_info(Req, Filepath, Extra); + << Dir:Len/binary >> -> + init_info(Req, Filepath, Extra); _ -> {cowboy_rest, Req, error} end. +%% We escape the slash found in path segments because +%% a segment corresponds to a directory entry, and +%% therefore those slashes are expected to be part of +%% the directory name. +%% +%% Note that on most systems the slash is prohibited +%% and cannot appear in filenames, which means the +%% requested file will end up being not found. +escape_reserved(<<>>, Acc) -> + Acc; +escape_reserved(<< $/, Rest/bits >>, Acc) -> + escape_reserved(Rest, << Acc/binary, $\\, $/ >>); +escape_reserved(<< C, Rest/bits >>, Acc) -> + escape_reserved(Rest, << Acc/binary, C >>). + fullpath(Path) -> fullpath(filename:split(Path), []). fullpath([], Acc) -> |