hls, webrtc: prevent XSS attack when appending slash to paths (#2766) (#2767)

internal/core/hls_http_server.go

@@ -146,11 +146,7 @@
  dir, fname = pa, ""
 
  if !strings.HasSuffix(dir, "/") {
- l := ctx.Request.URL.Path[1:] + "/"
- if ctx.Request.URL.RawQuery != "" {
- l += "?" + ctx.Request.URL.RawQuery
- }
- ctx.Writer.Header().Set("Location", l)
+ ctx.Writer.Header().Set("Location", httpserv.LocationWithTrailingSlash(ctx.Request.URL))
  ctx.Writer.WriteHeader(http.StatusMovedPermanently)
  return
  }

internal/core/webrtc_http_server.go

@@ -352,11 +352,7 @@ func (s *webRTCHTTPServer) onRequest(ctx *gin.Context) {
  s.onPage(ctx, ctx.Request.URL.Path[1:len(ctx.Request.URL.Path)-len("/publish")], true)
 
  case ctx.Request.URL.Path[len(ctx.Request.URL.Path)-1] != '/':
- l := ctx.Request.URL.Path[1:] + "/"
- if ctx.Request.URL.RawQuery != "" {
- l += "?" + ctx.Request.URL.RawQuery
- }
- ctx.Writer.Header().Set("Location", l)
+ ctx.Writer.Header().Set("Location", httpserv.LocationWithTrailingSlash(ctx.Request.URL))
  ctx.Writer.WriteHeader(http.StatusMovedPermanently)
 
  default:

internal/protocols/httpserv/location_with_trailing_slash.go

@@ -0,0 +1,12 @@
+package httpserv
+
+import "net/url"
+
+// LocationWithTrailingSlash returns the URL in a relative format, with a trailing slash.
+func LocationWithTrailingSlash(u *url.URL) string {
+ l := "./" + u.Path[1:] + "/"
+ if u.RawQuery != "" {
+ l += "?" + u.RawQuery
+ }
+ return l
+}

internal/protocols/httpserv/location_with_trailing_slash_test.go

@@ -0,0 +1,36 @@
+package httpserv
+
+import (
+ "net/url"
+ "testing"
+
+ "github.com/stretchr/testify/require"
+)
+
+func TestLocationWithTrailingSlash(t *testing.T) {
+ for _, ca := range []struct {
+ name string
+ url *url.URL
+ loc string
+ }{
+ {
+ "with query",
+ &url.URL{
+ Path: "/test",
+ RawQuery: "key=value",
+ },
+ "./test/?key=value",
+ },
+ {
+ "xss",
+ &url.URL{
+ Path: "/www.example.com",
+ },
+ "./www.example.com/",
+ },
+ } {
+ t.Run(ca.name, func(t *testing.T) {
+ require.Equal(t, ca.loc, LocationWithTrailingSlash(ca.url))
+ })
+ }
+}