beego: fixed serious Directory Traversal

astaxie · astaxie · commit 18fee2ad9a7e · 2014-04-08T17:43:25.000+08:00
diff --git a/staticfile.go b/staticfile.go
@@ -13,7 +13,7 @@ import (
 )
 
 func serverStaticRouter(ctx *context.Context) bool {
-	requestPath := ctx.Input.Request.URL.Path
+	requestPath := path.Clean(ctx.Input.Request.URL.Path)
 	for prefix, staticDir := range StaticDir {
 		if len(prefix) == 0 {
 			continue

Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,7 @@ import (`
`13`	`13`	`)`
`14`	`14`
`15`	`15`	`func serverStaticRouter(ctx *context.Context) bool {`
`16`		`- requestPath := ctx.Input.Request.URL.Path`
	`16`	`+ requestPath := path.Clean(ctx.Input.Request.URL.Path)`
`17`	`17`	`for prefix, staticDir := range StaticDir {`
`18`	`18`	`if len(prefix) == 0 {`
`19`	`19`	`continue`