wt/cpp-httplib
1
0 Fork 0
mirror of https://github.com/yhirose/cpp-httplib.git synced 2026-10-23 11:54:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refuse to serve a path segment ending in a dot or a space

Browse Source 
Windows trims a trailing '.' or space from a file name, so a mount
point there served a file under a path other than the one a pre-routing
handler checked. A mount point now serves no path with a segment
ending in '.' or a space, on every platform; "." and ".." are among
them. The README no longer lists such names among the ones the file
system can still alias.
This commit is contained in:
yhirose committed 2026-10-22 11:16:27 -04:00
1 parent 70bed02bc9
commit b4b24589ad
3 files changed
+19 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

httplib.h
+6 -5
View File
@@ -5988,9 +5988,10 @@ inline bool is_valid_close_payload(const std::string &payload) {
namespace detail {
// A path a mount point serves: absolute, with no ".", ".." or empty segment
// except a trailing '/', so the file served is the one that req.path names to
// the handlers that ran before it.
// A path a mount point serves: absolute, with no empty segment except a
// trailing '/' and no segment ending in '.' or a space (which covers "." and
// ".." and names Windows trims into another file's name), so the file served
// is the one that req.path names to the handlers that ran before it.
inline bool is_valid_path(const std::string &path) {
if (path.empty() || path[0] != '/') { return false; }
@@ -6001,8 +6002,8 @@ inline bool is_valid_path(const std::string &path) {
continue;
}
auto len = i - beg;
if ((len == 0 && i < path.size()) || (len == 1 && path[beg] == '.') ||
(len == 2 && path[beg] == '.' && path[beg + 1] == '.')) {
if ((len == 0 && i < path.size()) ||
(len > 0 && (path[i - 1] == '.' || path[i - 1] == ' '))) {
return false;
}
beg = i + 1;