Skip to content

Instantly share code, notes, and snippets.

/static.diff Secret

Created February 2, 2015 15:53
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save anonymous/1bb83b20ff53966e3eab to your computer and use it in GitHub Desktop.
Save anonymous/1bb83b20ff53966e3eab to your computer and use it in GitHub Desktop.
diff --git a/lib/Mojolicious/Static.pm b/lib/Mojolicious/Static.pm
index 82d546a..8deb398 100644
--- a/lib/Mojolicious/Static.pm
+++ b/lib/Mojolicious/Static.pm
@@ -33,7 +33,8 @@ sub dispatch {
return undef unless my @parts = @{$path->canonicalize->parts};
# Serve static file and prevent directory traversal
- return undef if $parts[0] eq '..' || !$self->serve($c, join('/', @parts));
+ return undef
+ if grep({/^\.+$/} @$path) || !$self->serve($c, join('/', @parts));
$stash->{'mojo.static'} = 1;
return !!$c->rendered;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment