Fix security issue (DEGoodmanWilson#61)

arpit2297 · Oct 3, 2018 · a26baea · a26baea
1 parent de6f061
commit a26baea
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/luna/router.cpp b/luna/router.cpp
@@ -63,7 +63,10 @@ void router::handle_request(request_method method,
 }
 
 void router::serve_files(std::string mount_point, std::string path_to_files)
-{
+{   
+    std::regex parent_dir_pattern("(../)+");
+    path_to_files = std::regex_replace(path_to_files, parent_dir_pattern, "");
+
     std::regex route{mount_point + "(.*)"};
     std::string local_path{path_to_files + "/"};
     handle_request(request_method::GET, route, [=](const request &req) -> response