2 commits

Author	SHA1	Message	Date
Andrew Nesbitt	a4fd333d48	Check for path traversal after URL decoding (#108) ... containsPathTraversal only checked literal ".." segments separated by forward slashes. Encoded forms like %2e%2e%2f or backslash separators would slip past if a caller ever passed a raw or Windows-style path. The check now URL-decodes the input and treats backslashes as separators before splitting. Go's stdlib already decodes r.URL.Path so the encoded case is mostly belt-and-braces for cache keys and other non-router inputs, but the storage layer guard from #106 makes this worth locking in with tests. Fixes #74	2026-05-03 09:07:16 +01:00
Andrew Nesbitt	bf7e83efe3	Reject path traversal in debian and rpm handlers ... The debian and rpm handlers take the request path and pass it directly to the upstream URL without checking for ".." segments. This could let a client craft a request that reaches unintended upstream paths. Add a containsPathTraversal check at the entry point of both handlers and return 400 for any path containing ".." segments.	2026-03-12 12:05:52 +00:00