diff --git a/apps/etorrent/src/etorrent_cowboy_handler.erl b/apps/etorrent/src/etorrent_cowboy_handler.erl index 58675cc6..8fbc9aa2 100644 --- a/apps/etorrent/src/etorrent_cowboy_handler.erl +++ b/apps/etorrent/src/etorrent_cowboy_handler.erl @@ -181,11 +181,28 @@ conv_number(F) when is_float(F) -> float_to_list(F). sanitize(Path) -> case lists:all(fun allowed/1, Path) of true -> - Path; + dot_check(Path); false -> "index.html" end. +dot_check(Path) -> + case dot_check1(Path) of + ok -> + Path; + fail -> + "index.html" + end. + +dot_check1([$., $/ | _]) -> fail; +dot_check1([$/, $/ | _]) -> fail; +dot_check1([$/, $. | _]) -> fail; +dot_check1([$., $. | _]) -> fail; +dot_check1([_A, B | Next]) -> dot_check1([B | Next]); +dot_check1(".") -> fail; +dot_check1("/") -> fail; +dot_check1(L) when is_list(L) -> ok. + allowed(C) when C >= $a, C =< $z -> true; allowed(C) when C >= $A, C =< $Z -> true; allowed(C) when C >= $0, C =< $9 -> true;