all repos — honk @ d33a14dd21198256e64e406e08aecfb74109d4c6

my fork of honk

shouldn't need to query escape meme names, and don't allow / to prevent traversal
Ted Unangst tedu@tedunangst.com
Tue, 26 Nov 2019 13:47:33 -0500
commit

d33a14dd21198256e64e406e08aecfb74109d4c6

parent

a44abed4a132d343fc15b4f5f1ca25c7a2654e78

1 files changed, 4 insertions(+), 12 deletions(-)

jump to
M web.goweb.go

@@ -2025,21 +2025,13 @@ log.Print(err)

} } func serveemu(w http.ResponseWriter, r *http.Request) { - xid := mux.Vars(r)["xid"] - emu, err := url.QueryUnescape(xid) - if err != nil { - log.Print(err) - } + emu := mux.Vars(r)["emu"] w.Header().Set("Cache-Control", "max-age="+somedays()) http.ServeFile(w, r, dataDir+"/emus/"+emu) } func servememe(w http.ResponseWriter, r *http.Request) { - xid := mux.Vars(r)["xid"] - meme, err := url.QueryUnescape(xid) - if err != nil { - log.Print(err) - } + meme := mux.Vars(r)["meme"] w.Header().Set("Cache-Control", "max-age="+somedays()) http.ServeFile(w, r, dataDir+"/memes/"+meme)

@@ -2289,8 +2281,8 @@ getters.HandleFunc("/a", avatate)

getters.HandleFunc("/o", thelistingoftheontologies) getters.HandleFunc("/o/{name:.+}", showontology) getters.HandleFunc("/d/{xid:[[:alnum:].]+}", servefile) - getters.HandleFunc("/emu/{xid:.+}", serveemu) - getters.HandleFunc("/meme/{xid:.+}", servememe) + getters.HandleFunc("/emu/{emu:[^/]+}", serveemu) + getters.HandleFunc("/meme/{meme:[^/]+}", servememe) getters.HandleFunc("/.well-known/webfinger", fingerlicker) getters.HandleFunc("/server", serveractor)