Update HttpRequestHandler.java

ffay · Aug 25, 2021 · 7787a14 · 7787a14
1 parent 5929e1b
commit 7787a14
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/proxy-server/src/main/java/org/fengfei/lanproxy/server/config/web/HttpRequestHandler.java b/proxy-server/src/main/java/org/fengfei/lanproxy/server/config/web/HttpRequestHandler.java
@@ -74,9 +74,13 @@ private void outputContent(ChannelHandlerContext ctx, FullHttpRequest request, i
      */
     private void outputPages(ChannelHandlerContext ctx, FullHttpRequest request) throws Exception {
         HttpResponseStatus status = HttpResponseStatus.OK;
-        String url = request.getUri().replace(".", "");
-        URI uri = new URI(url);
+        URI uri = new URI(request.getUri());
         String uriPath = uri.getPath();
+        if (uriPath.contains("../")) {
+            status = HttpResponseStatus.FORBIDDEN;
+            outputContent(ctx, request, status.code(), status.toString(), "text/html");
+            return;
+        }
         uriPath = uriPath.equals("/") ? "/index.html" : uriPath;
         String path = PAGE_FOLDER + uriPath;
         File rfile = new File(path);