From 71e17cb15bdddf1a2c8e209446b4e353be246ddd Mon Sep 17 00:00:00 2001 From: frosty Date: Tue, 10 Mar 2026 01:30:21 -0400 Subject: fix: path traversal and cookie buffer issues --- src/routing.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'src/routing.c') diff --git a/src/routing.c b/src/routing.c index 98bb531..d5d3969 100644 --- a/src/routing.c +++ b/src/routing.c @@ -256,7 +256,14 @@ char *parse_request_url(const char *request_line, UrlParams *params) { bool serve_static_file_with_mime(const char *request_path_relative_to_static, const char *mime_type) { char full_static_path[MAX_PATH_LEN]; - if (strstr(request_path_relative_to_static, "..") != NULL) { + if (request_path_relative_to_static == NULL || strlen(request_path_relative_to_static) == 0) { + fprintf(stderr, "[ERROR] serve_static_file_with_mime: Empty path provided\n"); + return false; + } + + if (strstr(request_path_relative_to_static, "..") != NULL || + strstr(request_path_relative_to_static, "//") != NULL || + request_path_relative_to_static[0] == '/') { fprintf(stderr, "[SECURITY] Attempted directory traversal: %s\n", request_path_relative_to_static); const char *forbidden_response = -- cgit v1.2.3