Matthew Ingwersen 3c38dae599 Fix directory traversal vulnerability ... When computing the filesystem path to serve, each URL path segment appended to the content directory path must be checked to ensure that it consists only of normal filesystem path components (and not the root directory, .., drive labels, or other special components). Otherwise, the following directory traversal attacks are possible: - When an absolute path is pushed onto a PathBuf, the PathBuf will be overwritten. If we don't check for absolute paths, Agate can be tricked into serving an arbitrary absolute filesystem path via a URL like gemini://example.com/%2Fetc/passwd - The url crate eliminates all .. segments from the URL when parsing, even when these are percent-encoded. However, .. can be injected into the computed filesystem path by using a URL path segment that, when decoded, contains more than one filesystem path component, like gemini://example.com/subdir%2F..%2F../outside_content_dir Furthermore, path separators appearing within a single URL path segment, like escaped / (%2F), should probably not be considered structural [0]. That is, "a%2Fb" refers to a resource literally named "a/b", not "b" in subdirectory "a". Thus we also check that a URL path segment represents no more than one filesystem path segment. [0] https://www.w3.org/Addressing/URL/4_URI_Recommentations.html		2021-06-08 08:22:00 +02:00
..
certificates.rs	add automatic certificate generation	2021-03-27 00:52:50 +01:00
main.rs	Fix directory traversal vulnerability	2021-06-08 08:22:00 +02:00
metadata.rs	resolve clippy warning	2021-03-27 20:31:06 +01:00