Directory traversal with malformed HTTP request

#330
webp-sh · Apr 22, 2024 · 0adffe6 · 0adffe6
1 parent c7bebfc
commit 0adffe6
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/handler/router.go b/handler/router.go
@@ -22,6 +22,12 @@ func Convert(c *fiber.Ctx) error {
 	// 2. generate rawImagePath, could be local path or remote url(possible with query string)
 	// 3. pass it to encoder, get the result, send it back
 
+	// normal http request will start with /
+	if !strings.HasPrefix(c.Path(), "/") {
+		_ = c.SendStatus(http.StatusBadRequest)
+		return nil
+	}
+
 	var (
 		reqHostname = c.Hostname()
 		reqHost     = c.Protocol() + "://" + reqHostname // http://www.example.com:8000