dany/luasocket
1
0
Fork 0
mirror of https://github.com/lunarmodules/luasocket.git synced 2025-07-13 14:14:30 +02:00
Code Issues Packages Projects Releases Wiki Activity

url.lua:remove_dot_components(): limit beginning-of-string double-dot corner case to prevent triple-dot activation and authority collision

Browse Source
This commit is contained in:
E. Westbrook
2018-08-21 09:07:42 -06:00
parent c905b5d44f
commit c570a32c21
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/url.lua
View File

@ -94,7 +94,7 @@ local function remove_dot_components(path)
path = path:gsub('[^/]+/%.%./*$', '')
path = path:gsub('/%.%.$', '/')
path = path:gsub('/%.$', '/')
path = path:gsub('^/%.%.', '')
path = path:gsub('^/%.%./', '/')
return path
end