Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix LFI in zola serve #2258

Merged
merged 2 commits into from
Aug 4, 2023
Merged

Fix LFI in zola serve #2258

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8d514e8
use fs canonicalize to prevent path traversal
adeadfed Jul 24, 2023
219fe9b
fix cargo fmt
adeadfed Jul 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/cmd/serve.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,14 @@ async fn handle_request(req: Request<Body>, mut root: PathBuf) -> Result<Respons
// otherwise `PathBuf` will interpret it as an absolute path
root.push(&decoded[1..]);

// Resolve the root + user supplied path into the absolute path
// this should hopefully remove any path traversals
// if we fail to resolve path, we should return 404
root = match tokio::fs::canonicalize(&root).await {
Ok(d) => d,
Err(_) => return Ok(not_found()),
};

// Ensure we are only looking for things in our public folder
if !root.starts_with(original_root) {
return Ok(not_found());
Expand Down