Fix Snap.Util.FileServe.getSafePath to reject non-relative paths

cvb · Nov 10, 2010 · dcd9993 · dcd9993
1 parent e3f79bf
commit dcd9993
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/Snap/Util/FileServe.hs b/src/Snap/Util/FileServe.hs
@@ -172,10 +172,14 @@ getSafePath = do
     req <- getRequest
     let p = S.unpack $ rqPathInfo req
 
+    -- relative paths only!
+    when (not $ isRelative p) pass
+
     -- check that we don't have any sneaky .. paths
     let dirs = splitDirectories p
     when (elem ".." dirs) pass
-    return p
+
+    return $ joinPath dirs
 
 
 ------------------------------------------------------------------------------