alexferl / zerohttp / 23009725087

94%

push

github

feat: add path traversal protection to static file handler

Add check for ".." in raw URL path before cleaning. Blocks traversal
attempts early with logging. Uses path.Clean (not filepath.Clean) for
URL paths. fs.FS enforces this via fs.ValidPath at Open time as
defense in depth. Includes test for encoded traversal attempts.

Signed-off-by: alexferl <me@alexferl.com>

10 of 10 new or added lines in 1 file covered. (100.0%)

8367 of 8956 relevant lines covered (93.42%)

45.26 hits per line