From 724e77fc0cc6889642f65c7a0e369f644676d80c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Kierski?= Date: Fri, 7 Apr 2023 17:20:44 +0200 Subject: [PATCH] fix: use platform independent absolute path algorithm Fixes issue https://github.com/hibiken/asynqmon/issues/257 --- static.go | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/static.go b/static.go index aea41b0..20d60fa 100644 --- a/static.go +++ b/static.go @@ -29,11 +29,7 @@ type uiAssetsHandler struct { // serve the file specified by the URL path. func (h *uiAssetsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { // Get the absolute path to prevent directory traversal. - path, err := filepath.Abs(r.URL.Path) - if err != nil { - http.Error(w, err.Error(), http.StatusBadRequest) - return - } + path := filepath.filepath.ToSlash(filepath.Clean(r.URL.Path)) // Get the path relative to the root path. if !strings.HasPrefix(path, h.rootPath) {