wjqserver/touka
1
0
Fork 0
mirror of https://github.com/infinite-iroha/touka.git synced 2026-02-03 00:41:10 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix path to filepath

Browse source
This commit is contained in:
wjqserver 2025-10-21 15:06:26 +08:00
parent 1361f6e237
commit e4aaaa1583
1 changed files with 3 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
context.go
View file

@ -18,7 +18,6 @@ import (
"net/netip" "net/netip"
"net/url" "net/url"
"os" "os"
"path"
"path/filepath" "path/filepath"
"strings" "strings"
"sync" "sync"
@ -284,17 +283,12 @@ func (c *Context) Text(code int, text string) {
// FileText // FileText
func (c *Context) FileText(code int, filePath string) { func (c *Context) FileText(code int, filePath string) {
// 清理path // 清理path
cleanPath := path.Clean(filePath) cleanPath := filepath.Clean(filePath)
if !filepath.IsAbs(cleanPath) { if !filepath.IsAbs(cleanPath) {
c.AddError(fmt.Errorf("relative path not allowed: %s", cleanPath)) c.AddError(fmt.Errorf("relative path not allowed: %s", cleanPath))
c.ErrorUseHandle(http.StatusBadRequest, fmt.Errorf("relative path not allowed")) c.ErrorUseHandle(http.StatusBadRequest, fmt.Errorf("relative path not allowed"))
return return
} }
if strings.Contains(cleanPath, "..") {
c.AddError(fmt.Errorf("path traversal attempt detected: %s", cleanPath))
c.ErrorUseHandle(http.StatusBadRequest, fmt.Errorf("path traversal attempt detected"))
return
}
// 检查文件是否存在 // 检查文件是否存在
if _, err := os.Stat(cleanPath); os.IsNotExist(err) { if _, err := os.Stat(cleanPath); os.IsNotExist(err) {
c.AddError(fmt.Errorf("file not found: %s", cleanPath)) c.AddError(fmt.Errorf("file not found: %s", cleanPath))
@ -868,7 +862,7 @@ func (c *Context) GetRequestURIPath() string {
// 将文件内容作为响应body // 将文件内容作为响应body
func (c *Context) SetRespBodyFile(code int, filePath string) { func (c *Context) SetRespBodyFile(code int, filePath string) {
// 清理path // 清理path
cleanPath := path.Clean(filePath) cleanPath := filepath.Clean(filePath)
// 打开文件 // 打开文件
file, err := os.Open(cleanPath) file, err := os.Open(cleanPath)
@ -888,7 +882,7 @@ func (c *Context) SetRespBodyFile(code int, filePath string) {
} }
// 尝试根据文件扩展名猜测 Content-Type // 尝试根据文件扩展名猜测 Content-Type
contentType := mime.TypeByExtension(path.Ext(cleanPath)) contentType := mime.TypeByExtension(filepath.Ext(cleanPath))
if contentType == "" { if contentType == "" {
// 如果无法猜测，则使用默认的二进制流类型 // 如果无法猜测，则使用默认的二进制流类型
contentType = "application/octet-stream" contentType = "application/octet-stream"