Security Fix: Filesystem traversal bug

[khaf]

This PR fixes an issue where encoded URLs could escape the static directory and traverse the filesystem.

[coveralls]

Coverage decreased (-0.1%) to 81.846% when pulling 5577b3a on khaf:fix_static_traversal into c3887eb on labstack:master.

[coveralls]

Coverage decreased (-0.1%) to 81.846% when pulling 5577b3a on khaf:fix_static_traversal into c3887eb on labstack:master.

[vishr]

@khaf Can you provide an example or better may be a test case to understand and document it better?

[khaf]

Sure, these are the type of URLs that may hit the server:

[*] Testing Path: http://127.0.0.1:8081/..%2f..%2f..%2fetc%2fissue <- VULNERABLE!
[*] Testing Path: http://127.0.0.1:8081/..%2f..%2f..%2f..%2fetc%2fpasswd <- VULNERABLE!
[*] Testing Path: http://127.0.0.1:8081/..%2f..%2f..%2f..%2fetc%2fissue <- VULNERABLE!
[*] Testing Path: http://127.0.0.1:8081/..%2f..%2f..%2f..%2f..%2fetc%2fpasswd <- VULNERABLE!

These are out of the following tool: https://github.com/wireghoul/dotdotpwn

This happens as a result of not sanitizing the encoded input (in this case URL path) before passing it to the path.Clean method.

[vishr]

@khaf Nice! Just need to write a test case and I will get it merged asap.

[vishr]

@khaf This is fixed differently, please verify.

[khaf]

Looks like it is fixed now. Thanks.