Mercurial > prosody-hg

comparison net/http/parser.lua @ 14171:190d172ab021 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
net.http.parser: Add explanatory comment about scope of preprocess_path
author Matthew Wild <mwild1@gmail.com>
date Mon, 25 May 2026 13:07:32 +0100
parents 948bda5ed45f
children
comparison
equal deleted inserted replaced
14170:948bda5ed45f 14171:190d172ab021
2 local assert = assert; 2 local assert = assert;
3 local url_parse = require "socket.url".parse; 3 local url_parse = require "socket.url".parse;
4 local urldecode = require "prosody.util.http".urldecode; 4 local urldecode = require "prosody.util.http".urldecode;
5 local dbuffer = require "prosody.util.dbuffer"; 5 local dbuffer = require "prosody.util.dbuffer";
6 6
7
8 -- This is a basic check, and does *not* fully prevent path traversal (CWE-22).
9 -- If the path will be mapped to a filesystem, further processing and checks
10 -- are needed for safety and compliance. This is handled by net.http.files.
7 local function preprocess_path(path) 11 local function preprocess_path(path)
8 path = urldecode((path:gsub("//+", "/"))); 12 path = urldecode((path:gsub("//+", "/")));
9 if path:sub(1,1) ~= "/" then 13 if path:sub(1,1) ~= "/" then
10 path = "/"..path; 14 path = "/"..path;
11 end 15 end