Mercurial > prosody-hg
diff net/http/parser.lua @ 14171:190d172ab021 13.0
net.http.parser: Add explanatory comment about scope of preprocess_path
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Mon, 25 May 2026 13:07:32 +0100 |
| parents | 948bda5ed45f |
| children |
line wrap: on
line diff
--- a/net/http/parser.lua Mon May 25 13:06:51 2026 +0100 +++ b/net/http/parser.lua Mon May 25 13:07:32 2026 +0100 @@ -4,6 +4,10 @@ local urldecode = require "prosody.util.http".urldecode; local dbuffer = require "prosody.util.dbuffer"; + +-- This is a basic check, and does *not* fully prevent path traversal (CWE-22). +-- If the path will be mapped to a filesystem, further processing and checks +-- are needed for safety and compliance. This is handled by net.http.files. local function preprocess_path(path) path = urldecode((path:gsub("//+", "/"))); if path:sub(1,1) ~= "/" then