# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1779710852 -3600
# Node ID 190d172ab021a7082c38f0e33993bcd82093ba7b
# Parent  948bda5ed45fde31e37ac9506ea5e99329a8a70f
net.http.parser: Add explanatory comment about scope of preprocess_path

diff -r 948bda5ed45f -r 190d172ab021 net/http/parser.lua
--- a/net/http/parser.lua	Mon May 25 13:06:51 2026 +0100
+++ b/net/http/parser.lua	Mon May 25 13:07:32 2026 +0100
@@ -4,6 +4,10 @@
 local urldecode = require "prosody.util.http".urldecode;
 local dbuffer = require "prosody.util.dbuffer";
 
+
+-- This is a basic check, and does *not* fully prevent path traversal (CWE-22).
+-- If the path will be mapped to a filesystem, further processing and checks
+-- are needed for safety and compliance. This is handled by net.http.files.
 local function preprocess_path(path)
 	path = urldecode((path:gsub("//+", "/")));
 	if path:sub(1,1) ~= "/" then