shithub: rc-gemd

Info  •  Files  •  Log  •  Branches

fix urlencode escape, copied from rc-httpd

--- a/handlers/dir-index

+++ b/handlers/dir-index

@@ -1,6 +1,10 @@

 #!/bin/rc

 full_path=`{echo $"fs_root^$"location | urlencode -d}

 full_path=$"full_path

+if(! ~ `{cleanname -d$fs_root $full_path} `{cleanname $fs_root}^*){

+	error 53 'path not allowed'

+	exit

+}

 echo '20 text/gemini'^$cr

 ls $full_path | sed '

--- a/handlers/serve-static

+++ b/handlers/serve-static

@@ -1,6 +1,10 @@

 #!/bin/rc

 full_path=`{echo $"fs_root^$"location | urlencode -d}

 full_path=$"full_path

+if(! ~ `{cleanname -d$fs_root $full_path} `{cleanname $fs_root}^*){

+	error 53 'path not allowed'

+	exit

+}

 if(! test -e $full_path){

 	error 51 'file does not exist'