Comments (3)
Note that empty components in a path are ignored: /
, //
, and ///////
all name the same directory.
With that in mind, a client can currently access any file the server process can access on the host machine using a path like //etc/passwd
because the server only truncates a single leading /
from the request URI's path.
Lines 349 to 350 in 10103f5
Example
$ curl -vs http://127.0.0.1:7878//etc/passwd
root:x:0:0:root:/root:/bin/bash
...
Possible alternative strategy is
- ensure the static directory path is absolute
canonicalize
the static directory path- join the uri path to the static directory path
canonicalize
the result- check that the result
starts_with
the static directory path
from simple-server.
It's not applicable verbatim, but Rocket's security checks for paths might be a good starting point: https://github.com/SergioBenitez/Rocket/blob/master/lib/src/request/param.rs#L328.
from simple-server.
Or how does this look to mitigate it? https://github.com/scurest/simple-server/commit/3ed6abe1a61e18f6dfdf3484902945d2a1e23699
We trim the single leading slash, put the rest into a path and iterate over its components, pushing the normals ones onto static_directory
, but counting any non-normal component as a transversal attack.
edit: can make it even simpler. https://github.com/scurest/simple-server/commit/d2ccf63192e1904185913c03e493d59f5e6d8e62
from simple-server.
Related Issues (20)
- Allow closures in Server::new HOT 2
- body() sometimes returns zeroed slice HOT 9
- Allow changing uid/gid after binding HOT 2
- When serving static files, they always must be in `public` directory. HOT 1
- Prepare 0.4 release
- Option to disable serving static files? HOT 4
- Send Date response header HOT 1
- Make error handling more convenient
- Only one connection being handled at a time HOT 3
- 93-byte limit for request body? HOT 2
- Terminating the server
- Request body is empty while making post request from "reqwest" HOT 1
- thread '<unnamed>' panicked at 'attempt to subtract with overflow' HOT 3
- Content-Length or Transfer-Encoding header (RFC 7230) HOT 3
- README has 0.1.0 HOT 6
- Support `/` as `index.html` in static file serving HOT 1
- Location header seems to not be working HOT 2
- Since Server::listen blocks forever should it be marked diverging? HOT 1
- Allow serving in places other than the current working directory
- A method that listens on a TcpListener.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from simple-server.