From f29807aad80bf9782391892079ef68efa0c05db9 Mon Sep 17 00:00:00 2001
From: Sergey Lyubka <valenok@gmail.com>
Date: Wed, 22 Dec 2021 18:05:03 +0000
Subject: [PATCH] Resolve root path before serving to avoid double dots

---
 examples/http-server/main.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/examples/http-server/main.c b/examples/http-server/main.c
index b2be19c4..c87b7e4b 100644
--- a/examples/http-server/main.c
+++ b/examples/http-server/main.c
@@ -5,7 +5,7 @@
 #include "mongoose.h"
 
 static const char *s_debug_level = "2";
-static const char *s_root_dir = ".";  // Attention: avoid double-dots, `..` !
+static const char *s_root_dir = NULL;
 static const char *s_listening_address = "http://localhost:8000";
 static const char *s_enable_hexdump = "no";
 static const char *s_ssi_pattern = "#.html";
@@ -43,6 +43,8 @@ static void usage(const char *prog) {
 }
 
 int main(int argc, char *argv[]) {
+  char path[MG_PATH_MAX] = ".";
+  const char *root_dir = ".";
   struct mg_mgr mgr;
   struct mg_connection *c;
   int i;
@@ -50,7 +52,7 @@ int main(int argc, char *argv[]) {
   // Parse command-line flags
   for (i = 1; i < argc; i++) {
     if (strcmp(argv[i], "-d") == 0) {
-      s_root_dir = argv[++i];
+      root_dir = argv[++i];
     } else if (strcmp(argv[i], "-H") == 0) {
       s_enable_hexdump = argv[++i];
     } else if (strcmp(argv[i], "-S") == 0) {
@@ -64,6 +66,10 @@ int main(int argc, char *argv[]) {
     }
   }
 
+  // Root directory must not contain double dots. Make it absolute
+  realpath(root_dir, path);
+  s_root_dir = path;
+
   // Initialise stuff
   signal(SIGINT, signal_handler);
   signal(SIGTERM, signal_handler);