Wondering about the easiest way of checking whether a file is located inside a directory. For a directory dir, something that matches dir/foo, dir/dir2/bar, ./dir/foo, but not dir/../baz

@vaporeon_ is there a reason you can’t just normalize the path furst to remove . and .. ?

@aescling Yeah, I could do that, and then check whether the path starts with dir. Was a little worried about performance, but if it's a normal path with no . or .. in it, it's just one read of the string. And if there are . or .., it's still not that much processing as to significantly affect server operation...

@aescling So there are no existing functions that can just tell me?

@aescling Ooh, I actually could do something sillier to save a few CPU cycles! It's for a Gopher server, and it just happens to be that the selectors are intended to map onto filenames, that a selector /foo/bar serves a file /foo/bar. There's nothing stopping me from simply rejecting ./foo/bar and /dir/../baz for the reason of not being valid selectors, even though they're valid paths on the filesystem

tangential 

@vaporeon_ funnily, the HTTP standard says . and .. directories in the “resource” are invalid but i have seen clients just send such resources verbatim to the server

re: tangential 

@aescling > clients send just such resources verbatim to the server

Did the server respond? Did it send the client the files it wanted despite the path containing such . and ..?

Follow

re: tangential 

@vaporeon_ i don't remember how http servers responded in general, i just remember that i had to account fur the pawsibility when writing an http server myself

Sign in to participate in the conversation
📟🐱 GlitchCat

A small, community‐oriented Mastodon‐compatible Fediverse (GlitchSoc) instance managed as a joint venture between the cat and KIBI families.