diff --git a/tty-fwd/src/api_server.rs b/tty-fwd/src/api_server.rs index b3e28464..a820e412 100644 --- a/tty-fwd/src/api_server.rs +++ b/tty-fwd/src/api_server.rs @@ -115,8 +115,11 @@ fn serve_static_file(static_root: &Path, request_path: &str) -> Option cleaned: '{}' -> file_path: '{}'", request_path, cleaned_path, file_path.display()); + // Security check: ensure the file path is within the static root if !file_path.starts_with(static_root) { + println!("Security check failed: file_path does not start with static_root"); return None; } @@ -149,7 +152,9 @@ fn serve_static_file(static_root: &Path, request_path: &str) -> Option Some( Response::builder() @@ -171,9 +176,11 @@ fn serve_static_file(static_root: &Path, request_path: &str) -> Option exists: {}, is_dir: {}", static_dir, static_dir_path.exists(), static_dir_path.is_dir()); if static_dir_path.exists() && static_dir_path.is_dir() { if let Some(static_response) = serve_static_file(static_dir_path, &path) { let _ = req.respond(static_response); return; } } + } else { + println!("No static_path configured"); } }