/
path_handler.go
40 lines (32 loc) · 1.16 KB
/
path_handler.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
// Copyright 2017 Axel Etcheverry. All rights reserved.
// Use of this source code is governed by a MIT
// license that can be found in the LICENSE file.
package middlewares
import (
"fmt"
"net/http"
"github.com/euskadi31/go-server/response"
"github.com/hyperscale/hyperpic/pkg/hyperpic/fsutil"
"github.com/rs/zerolog/log"
)
// NewPathHandler parse query string
func NewPathHandler() func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if fsutil.ContainsDotDot(r.URL.Path) {
// Too many programs use r.URL.Path to construct the argument to
// serveFile. Reject the request under the assumption that happened
// here and ".." may not be wanted.
// Note that name might not contain "..", for example if code (still
// incorrectly) used filepath.Join(myDir, r.URL.Path).
log.Error().Msgf("Invalid URL path: %s", r.URL.Path)
response.Failure(w, http.StatusBadRequest, response.ErrorMessage{
Code: http.StatusBadRequest,
Message: fmt.Sprintf("Invalid URL path: %s", r.URL.Path),
})
return
}
next.ServeHTTP(w, r)
})
}
}