cripslock

commit 02db18d7c6c835d828fe570c5f9ed9366ac04238
parent d8216b1f0b193adb8bd76ff8a6512ab8f8ba8a91
Author: Daniel Barlow <dan@telent.net>
Date:   Mon, 21 Jul 2025 22:31:44 +0100

implement site:static-path properly

Diffstat:
M
site.fnl
 | 
13
++++++++++++-

1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/site.fnl b/site.fnl
@@ -1,5 +1,7 @@
 (import-macros { : define-tests : expect : expect= } :assert)
 (local lfs (require :lfs))
+(local { : realpath } (require :posix.stdlib))
+
 
 ;; there are two date formats used in most of the extant posts:
 ;; "Fri Jun 29 14:17:56 2018" (emacs current-time-string)
@@ -112,6 +114,10 @@
                         (tset :body-offset (f:seek :cur 0))
                         (tset :date (and fields.date (parse-timestamp fields.date)))))))))))
 
+(fn static-path-ok? [basedir name]
+  (let [prefix (realpath basedir)
+        fullpath (realpath (.. basedir  name))]
+    (string.find fullpath prefix 1 true)))
 
 (fn for-pathname [path]
   (let [posts (index-posts path)]
@@ -119,7 +125,12 @@
      :get #(. posts $2)
      :search (fn [_] posts)
      :path path
-     :static-file (fn [name] (.. path "/" name))
+     :static-file (fn [name]
+                    (and (static-path-ok? path name) name))
      }))
 
+(define-tests :static-path
+  (expect (static-path-ok? "./" "/README.md"))
+  (expect (not (static-path-ok? "./tests/" "../README.md"))))
+
 { : for-pathname }