Skip to content

match mount points on a segment boundary in handle_file_request - #2529

Merged
yhirose merged 1 commit into
yhirose:masterfrom
metsw24-max:mount-point-segment-boundary
Aug 3, 2026
Merged

match mount points on a segment boundary in handle_file_request#2529
yhirose merged 1 commit into
yhirose:masterfrom
metsw24-max:mount-point-segment-boundary

Conversation

@metsw24-max

Copy link
Copy Markdown
Contributor

Mount point matched mid-segment in handle_file_request

The mount point is compared as a plain byte prefix, so a mount of /mount also serves /mountdir/... out of the same directory; with the pairing the ServerTest fixture already uses (/ on ./www, /mount on ./www2), GET /mountdir/test.html answers 200 with the contents of ./www2/dir/test.html. Nothing escapes the base directory since is_valid_path still rejects traversal, but the mounted tree becomes reachable under URLs outside the prefix the mount declares, so a reverse proxy location, auth filter or cache rule keyed on /mount/ quietly stops covering files it was meant to guard.

Matching now has to land on a segment boundary. A mount point that already ends in /, the root mount included, keeps its current behaviour, and set_mount_point guarantees the value is non-empty and starts with /.

@yhirose
yhirose merged commit 2b8658f into yhirose:master Aug 3, 2026
28 checks passed
@yhirose

yhirose commented Aug 3, 2026

Copy link
Copy Markdown
Owner

@metsw24-max thanks for the excellent contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants