Disallow reading hidden files

RamseyK · RamseyK · commit a1b5af2e77f9 · 2020-12-31T16:14:25.000-05:00
diff --git a/src/HTTPServer.cpp b/src/HTTPServer.cpp
@@ -621,7 +621,10 @@ void HTTPServer::sendStatusResponse(Client* cl, int status, std::string msg) {
 	resp->setStatus(Status(status));
 
 	// Body message: Reason string + additional msg
-	std::string body = resp->getReason() + ": " + msg;
+	std::string body = resp->getReason();
+	if (msg.length() > 0)
+		body +=  ": " + msg;
+
 	unsigned int slen = body.length();
 	char* sdata = new char[slen];
 	bzero(sdata, slen);
diff --git a/src/Resource.h b/src/Resource.h
@@ -69,6 +69,15 @@ class Resource {
 		return size;
 	}
 
+	// Get the file name
+	std::string getName() {
+		std::string name = "";
+		size_t slash_pos = location.find_last_of("/");
+		if (slash_pos != std::string::npos)
+			name = location.substr(slash_pos + 1);
+		return name;
+	}
+
 	// Get the file extension
 	std::string getExtension() {
 		std::string ext = "";
diff --git a/src/ResourceHost.cpp b/src/ResourceHost.cpp
@@ -66,9 +66,6 @@ Resource* ResourceHost::readFile(std::string path, struct stat sb) {
 		return NULL;
 
 	// Get the length of the file
-	/*file.seekg(0, std::ios::end);
-	len = file.tellg();
-	file.seekg(0, std::ios::beg);*/
 	len = sb.st_size;
 
 	// Allocate memory for contents of file and read in the contents
@@ -81,6 +78,15 @@ Resource* ResourceHost::readFile(std::string path, struct stat sb) {
 
 	// Create a new Resource object and setup it's contents
 	Resource* res = new Resource(path);
+	std::string name = res->getName();
+	if (name.length() == 0)
+		return NULL;  // Malformed name
+
+	// Always disallow hidden files
+	if (name.c_str()[0] == '.') {
+		return NULL;
+	}
+
 	std::string mimetype = lookupMimeType(res->getExtension());
 	if (mimetype.length() != 0)
 		res->setMimeType(mimetype);
