Mercurial > prosody-hg

changeset 14171:190d172ab021 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
net.http.parser: Add explanatory comment about scope of preprocess_path
author Matthew Wild <mwild1@gmail.com>
date Mon, 25 May 2026 13:07:32 +0100
parents 948bda5ed45f
children 94172bbf9074
files net/http/parser.lua
diffstat 1 files changed, 4 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/net/http/parser.lua	Mon May 25 13:06:51 2026 +0100
+++ b/net/http/parser.lua	Mon May 25 13:07:32 2026 +0100
@@ -4,6 +4,10 @@
 local urldecode = require "prosody.util.http".urldecode;
 local dbuffer = require "prosody.util.dbuffer";
 
+
+-- This is a basic check, and does *not* fully prevent path traversal (CWE-22).
+-- If the path will be mapped to a filesystem, further processing and checks
+-- are needed for safety and compliance. This is handled by net.http.files.
 local function preprocess_path(path)
 	path = urldecode((path:gsub("//+", "/")));
 	if path:sub(1,1) ~= "/" then