mirrors/sapphire
1
Fork 0
mirror of https://github.com/SapphireServer/Sapphire.git synced 2025-05-04 17:57:47 +00:00
Code Activity

fix an issue where some versions of std::fs would handle path generation differently

Browse source 
this changes the builtin http server to generate more reliable paths when parsing request bodies, fixes #635
This commit is contained in:
NotAdam 2020-02-17 15:45:27 +11:00
parent daaba2ea4d
commit 0306b68f88
2 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/api/main.cpp
View file

@ -671,8 +671,9 @@ void defaultGet( shared_ptr< HttpServer::Response > response, shared_ptr< HttpSe
print_request_info( request ); print_request_info( request );
try try
{ {
auto web_root_path = fs::canonical( "web" ); auto web_root_path = fs::current_path() / "web";
auto path = fs::canonical( web_root_path / request->path ); auto path = web_root_path / request->path;
//Check if path is within web_root_path //Check if path is within web_root_path
if( distance( web_root_path.begin(), web_root_path.end() ) > distance( path.begin(), path.end() ) || if( distance( web_root_path.begin(), web_root_path.end() ) > distance( path.begin(), path.end() ) ||
!std::equal( web_root_path.begin(), web_root_path.end(), path.begin() ) ) !std::equal( web_root_path.begin(), web_root_path.end(), path.begin() ) )

6
src/api/server_http.hpp
View file

@ -306,6 +306,12 @@ namespace SimpleWeb {
request->method=line.substr(0, method_end); request->method=line.substr(0, method_end);
request->path=line.substr(method_end+1, path_end-method_end-1); request->path=line.substr(method_end+1, path_end-method_end-1);
// strip first / from path if it exists
if( request->path[ 0 ] == '/' )
{
request->path = request->path.substr( 1 );
}
size_t protocol_end; size_t protocol_end;
if((protocol_end=line.find('/', path_end+1))!=std::string::npos) { if((protocol_end=line.find('/', path_end+1))!=std::string::npos) {
if(line.compare(path_end+1, protocol_end-path_end-1, "HTTP")!=0) if(line.compare(path_end+1, protocol_end-path_end-1, "HTTP")!=0)