From a6cca088dde07df7f801a9c571a77a3d4205d0cb Mon Sep 17 00:00:00 2001 From: Jose Quintana Date: Fri, 12 Feb 2021 16:50:42 +0100 Subject: [PATCH] fix: static file path resolving --- src/staticfile_middleware/staticfile.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/staticfile_middleware/staticfile.rs b/src/staticfile_middleware/staticfile.rs index 61ecb22..f3e9fd4 100644 --- a/src/staticfile_middleware/staticfile.rs +++ b/src/staticfile_middleware/staticfile.rs @@ -64,8 +64,10 @@ impl Staticfile { res }; - let path_resolved = PathBuf::from(helpers::adjust_canonicalization(path_resolved)); let base_path = if is_assets { &self.assets } else { &self.root }; + let path_resolved = PathBuf::from(helpers::adjust_canonicalization( + path_resolved.canonicalize()?, + )); // Protect against path/directory traversal if !path_resolved.starts_with(&base_path) { @@ -89,7 +91,10 @@ impl Handler for Staticfile { // Resolve path on file system let path_resolved = match self.resolve_path(&req.url.path()) { Ok(file_path) => file_path, - Err(_) => return Ok(Response::with(status::NotFound)), + Err(e) => { + trace!("{}", e); + return Ok(Response::with(status::NotFound)); + } }; // 1. Check if "directory listing" feature is enabled, -- libgit2 1.7.2