Fix Malformed dir traversal (#331)

* Directory traversal with malformed HTTP request #330 * bump version * also %2e * Use prefix to check invalid Path --------- Co-authored-by: n0vad3v <[email protected]>
webp-sh · Apr 23, 2024 · be32328 · be32328
1 parent c7bebfc
commit be32328
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/config/config.go b/config/config.go
@@ -50,7 +50,7 @@ var (
 	ProxyMode      bool
 	Prefetch       bool
 	Config         = NewWebPConfig()
-	Version        = "0.11.2"
+	Version        = "0.11.3"
 	WriteLock      = cache.New(5*time.Minute, 10*time.Minute)
 	ConvertLock    = cache.New(5*time.Minute, 10*time.Minute)
 	RemoteRaw      = "./remote-raw"

diff --git a/handler/router.go b/handler/router.go
@@ -22,6 +22,12 @@ func Convert(c *fiber.Ctx) error {
 	// 2. generate rawImagePath, could be local path or remote url(possible with query string)
 	// 3. pass it to encoder, get the result, send it back
 
+	// normal http request will start with /
+	if !strings.HasPrefix(c.Path(), "/") {
+		_ = c.SendStatus(http.StatusBadRequest)
+		return nil
+	}
+
 	var (
 		reqHostname = c.Hostname()
 		reqHost     = c.Protocol() + "://" + reqHostname // http://www.example.com:8000