[SECURITY] Prevent Path Traversal in website_handlers #15

New issue

Open

opened 2026-02-14 21:21:21 +00:00 by thabeta · 0 comments

thabeta commented

2026-02-14 21:21:21 +00:00

Owner

The server allows mounting and serving content via /website/:website_hash/*path (implemented in src/server/website_handlers.rs).

Risk: Without strict path normalization and checking, an attacker could provide a path containing .. to escape the intended flist root and read arbitrary files from the storage backend.

Proposed Fix: Ensure all paths are normalized and verified to reside within the intended directory subtree before processing.

The server allows mounting and serving content via `/website/:website_hash/*path` (implemented in `src/server/website_handlers.rs`). **Risk:** Without strict path normalization and checking, an attacker could provide a path containing `..` to escape the intended flist root and read arbitrary files from the storage backend. **Proposed Fix:** Ensure all paths are normalized and verified to reside within the intended directory subtree before processing.