hls, webrtc: prevent XSS attack when appending slash to paths (#2766) (…

…#2767) (#2772)

internal/core/hls_http_server.go

@@ -146,11 +146,7 @@ func (s *hlsHTTPServer) onRequest(ctx *gin.Context) {
 		dir, fname = pa, ""
 
 		if !strings.HasSuffix(dir, "/") {
-			l := ctx.Request.URL.Path[1:] + "/"
-			if ctx.Request.URL.RawQuery != "" {
-				l += "?" + ctx.Request.URL.RawQuery
-			}
-			ctx.Writer.Header().Set("Location", l)
+			ctx.Writer.Header().Set("Location", httpserv.LocationWithTrailingSlash(ctx.Request.URL))
 			ctx.Writer.WriteHeader(http.StatusMovedPermanently)
 			return
 		}

internal/core/webrtc_http_server.go

@@ -352,11 +352,7 @@ func (s *webRTCHTTPServer) onRequest(ctx *gin.Context) {
 				s.onPage(ctx, ctx.Request.URL.Path[1:len(ctx.Request.URL.Path)-len("/publish")], true)
 
 			case ctx.Request.URL.Path[len(ctx.Request.URL.Path)-1] != '/':
-				l := ctx.Request.URL.Path[1:] + "/"
-				if ctx.Request.URL.RawQuery != "" {
-					l += "?" + ctx.Request.URL.RawQuery
-				}
-				ctx.Writer.Header().Set("Location", l)
+				ctx.Writer.Header().Set("Location", httpserv.LocationWithTrailingSlash(ctx.Request.URL))
 				ctx.Writer.WriteHeader(http.StatusMovedPermanently)
 
 			default:

internal/protocols/httpserv/location_with_trailing_slash.go

@@ -0,0 +1,12 @@
+package httpserv
+
+import "net/url"
+
+// LocationWithTrailingSlash returns the URL in a relative format, with a trailing slash.
+func LocationWithTrailingSlash(u *url.URL) string {
+	l := "./" + u.Path[1:] + "/"
+	if u.RawQuery != "" {
+		l += "?" + u.RawQuery
+	}
+	return l
+}

internal/protocols/httpserv/location_with_trailing_slash_test.go

@@ -0,0 +1,36 @@
+package httpserv
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLocationWithTrailingSlash(t *testing.T) {
+	for _, ca := range []struct {
+		name string
+		url  *url.URL
+		loc  string
+	}{
+		{
+			"with query",
+			&url.URL{
+				Path:     "/test",
+				RawQuery: "key=value",
+			},
+			"./test/?key=value",
+		},
+		{
+			"xss",
+			&url.URL{
+				Path: "/www.example.com",
+			},
+			"./www.example.com/",
+		},
+	} {
+		t.Run(ca.name, func(t *testing.T) {
+			require.Equal(t, ca.loc, LocationWithTrailingSlash(ca.url))
+		})
+	}
+}