Skip to content

Commit 5eb3ec2

Browse files
committed
fix path traversal detection for files that does not exist
1 parent 4a1be95 commit 5eb3ec2

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

src/app/app.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -206,9 +206,8 @@ func (app *App) GetOrCreateResponseItem(requestedPath string, compression Compre
206206
func (app *App) GetFilePath(urlPath string) (string, bool) {
207207
requestedPath := path.Join(app.params.Directory, urlPath)
208208

209-
requestedPath, err := filepath.EvalSymlinks(requestedPath)
210-
if err != nil {
211-
return "", false
209+
if _, err := os.Stat(requestedPath); !os.IsNotExist(err) {
210+
requestedPath, err = filepath.EvalSymlinks(requestedPath)
212211
}
213212

214213
if !strings.HasPrefix(requestedPath, app.params.Directory) {

0 commit comments

Comments
 (0)