Fix directory traversal vulnerability under Windows (#29)

m3ng9i · Aug 19, 2021 · fcfc1a1 · fcfc1a1
1 parent 06c4cf7
commit fcfc1a1
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/server/context.go b/server/context.go
@@ -35,6 +35,9 @@ func newContext(config Config, r *http.Request) (c *context, err error) {
 
     requestPath := r.URL.Path
 
+    // Fix directory traversal vulnerability under Windows, see https://github.com/m3ng9i/ran/issues/29
+    requestPath = strings.ReplaceAll(requestPath, `\`, `/`)
+
     if !strings.HasPrefix(requestPath, "/") {
         requestPath = "/" + requestPath
     }