Skip to content

Fix incomplete path traversal check in FileResponse (nwu + nwu2) #1749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 3 commits into from
Closed

Fix incomplete path traversal check in FileResponse (nwu + nwu2) #1749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9410a4f
Initial plan
Copilot Mar 9, 2026
30c5079
fix(security): add File.separator to path traversal check in FileResp…
Copilot Mar 9, 2026
729df21
Merge branch 't8' into copilot/sub-pr-1747
nmaguiar Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions src/com/nwu/httpd/responses/FileResponse.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,12 +104,13 @@ public com.nwu.httpd.responses.Response serveFile(String uri,
"FORBIDDEN: Invalid path.");
}

// Prohibit getting out of current directory
if (relativeUri.startsWith("..") || relativeUri.endsWith("..")
|| relativeUri.indexOf("../") >= 0)
return new com.nwu.httpd.responses.SimpleResponse(httpd,
Codes.HTTP_FORBIDDEN, Codes.MIME_PLAINTEXT,
"FORBIDDEN: Won't serve ../ for security reasons.");
// Prohibit getting out of current directory
if (relativeUri.startsWith("..") || relativeUri.endsWith("..")
|| relativeUri.indexOf("../") >= 0
|| relativeUri.indexOf(".." + File.separator) >= 0)
return new com.nwu.httpd.responses.SimpleResponse(httpd,
Codes.HTTP_FORBIDDEN, Codes.MIME_PLAINTEXT,
"FORBIDDEN: Won't serve .. paths for security reasons.");

File f;
File baseDir;
Expand Down
40 changes: 3 additions & 37 deletions src/com/nwu2/httpd/responses/FileResponse.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,10 +106,11 @@ public com.nwu2.httpd.responses.Response serveFile(String uri,

// Prohibit getting out of current directory
if (relativeUri.startsWith("..") || relativeUri.endsWith("..")
|| relativeUri.indexOf("../") >= 0)
|| relativeUri.indexOf("../") >= 0
|| relativeUri.indexOf(".." + File.separator) >= 0)
return new com.nwu2.httpd.responses.SimpleResponse(httpd,
Codes.HTTP_FORBIDDEN, Codes.MIME_PLAINTEXT,
"FORBIDDEN: Won't serve ../ for security reasons.");
"FORBIDDEN: Won't serve .. paths for security reasons.");

File f;
File baseDir;
Expand All @@ -135,41 +136,6 @@ public com.nwu2.httpd.responses.Response serveFile(String uri,
Codes.HTTP_NOTFOUND, Codes.MIME_PLAINTEXT,
"Error 404, file not found.");

// List the directory, if necessary
if (f.isDirectory()) {
// Browsers get confused without '/' after the
// directory, send a redirect.
if (!uriForLinks.endsWith("/")) {
uriForLinks += "/";
// com.nwu2.httpd.responses.Response r = new com.nwu2.httpd.responses.SimpleResponse(
// httpd, Codes.HTTP_REDIRECT, Codes.MIME_HTML,
// "<html><head><meta http-equiv=\"refresh\" content=\"0; url=" + this.rURI + uri + "\"></head>"+HTML_STYLE+"<body>Redirected: <a href=\"" + this.rURI + uri + "\">"
// + this.rURI + uri + "</a></body></html>");
// r.addHeader("Location", this.rURI + uri);
// return r;
}

this.rURI = this.rURI.replaceAll("/+", "/");
uriForLinks = uriForLinks.replaceAll("/+", "/");

// First try index.html and index.htm
if (new File(f, "index.html").exists())
f = new File(f, "index.html");
else if (new File(f, "index.htm").exists())
f = new File(f, "index.htm");
// No index file, list the directory
else if (allowDirectoryListing) {
String[] files = f.list();
String msg = "<html>"+HTML_STYLE+"<body><h1>Directory /" + uriForLinks + "</h1><br/>";

if (uriForLinks.length() > 1) {
String u = uriForLinks.substring(0, uriForLinks.length() - 1);
int slash = u.lastIndexOf('/');
if (slash >= 0 && slash < u.length())
msg += "<b><a href=\"" + encodeUri(uriForLinks.substring(0, slash + 1))
+ "\">..</a></b><br/>";
}

for (int i = 0; i < files.length; ++i) {
File curFile = new File(f, files[i]);
boolean dir = curFile.isDirectory();
Expand Down
Loading