diff --git a/Cargo.lock b/Cargo.lock index e183697..916c105 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -10,7 +10,7 @@ checksum = "17cbf58e19f2bda088d8c4c95a46b41895375e15a2d63dd686a4273f8c43d46b" [[package]] name = "herb" -version = "0.8.1" +version = "0.8.2-develop" dependencies = [ "frostwalker", "packeteer", diff --git a/Cargo.toml b/Cargo.toml index 8d096d0..fcbdac9 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "herb" -version = "0.8.1" +version = "0.8.2-develop" edition = "2018" [dependencies] diff --git a/src/main.rs b/src/main.rs index a82967a..89dee32 100644 --- a/src/main.rs +++ b/src/main.rs @@ -335,6 +335,11 @@ fn process_request(request: Vec, settings: Settings) -> Resource { println!("Stream sent GET request."); } if request.location.segments.len() != 0 { + if request.location.segments[0] == ".." || request.location.segments[0] == "." { + let resource = Resource { contents: "

400 Bad Request

The request you sent appears to be malformed.

".to_string().into_bytes(), status_code: 400, mime: "text/html".to_string(), iscgi: false }; + return resource; + } + let segclone = request.location.segments.clone(); path = unwrap_url_into_segments(request.location); if path.contains(".cgi/") {