dan/liminix
1
0
Fork 5
Code

tufted: more robust merge-pathname impl

Browse Source
This commit is contained in:
Daniel Barlow 2024-12-17 17:24:40 +00:00
parent 464d046b5a
commit 2e5a8a572e
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkgs/tufted/tufted.fnl
View File

@ -16,10 +16,18 @@
(print (.. "TFTP serving from " options.base-directory)) (print (.. "TFTP serving from " options.base-directory))
(fn merge-pathname [directory filename] ;; this is a copy of anoia append-path
(if (directory:match "/$") (fn merge-pathname [dirname filename]
(.. directory filename) (let [base (or (string.match dirname "(.*)/$") dirname)
(.. directory "/" filename))) result []]
(each [component (string.gmatch filename "([^/]+)")]
(if (and (= component "..") (> (# result) 0))
(table.remove result)
(= component "..")
(error "path traversal attempt")
true
(table.insert result component)))
(.. base "/" (table.concat result "/"))))
(-> (->
(tftp:listen (tftp:listen