danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix: Allow double slashes in install script URLs

Browse source
This commit is contained in:
courtmanr@gmail.com 2025-11-24 17:58:00 +00:00
parent 6b84b9a2bf
commit 5031ba481b
1 changed files with 7 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
internal/api/router.go
View file

@ -1250,10 +1250,9 @@ func (r *Router) reloadSystemSettings() {
// ServeHTTP implements http.Handler // ServeHTTP implements http.Handler
func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) { func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
// Prevent path traversal attacks by cleaning the path // Prevent path traversal attacks
cleanPath := filepath.Clean(req.URL.Path) // We strictly block ".." to prevent directory traversal
// Reject requests with path traversal attempts if strings.Contains(req.URL.Path, "..") {
if strings.Contains(req.URL.Path, "..") || cleanPath != req.URL.Path {
// Return 401 for API paths to match expected test behavior // Return 401 for API paths to match expected test behavior
if strings.HasPrefix(req.URL.Path, "/api/") { if strings.HasPrefix(req.URL.Path, "/api/") {
http.Error(w, "Unauthorized", http.StatusUnauthorized) http.Error(w, "Unauthorized", http.StatusUnauthorized)
@ -1263,7 +1262,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
log.Warn(). log.Warn().
Str("ip", req.RemoteAddr). Str("ip", req.RemoteAddr).
Str("path", req.URL.Path). Str("path", req.URL.Path).
Str("clean_path", cleanPath).
Msg("Path traversal attempt blocked") Msg("Path traversal attempt blocked")
return return
} }
@ -1507,10 +1505,10 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
req.URL.Path == "/simple-stats" || req.URL.Path == "/simple-stats" ||
req.URL.Path == "/install-docker-agent.sh" || req.URL.Path == "/install-docker-agent.sh" ||
req.URL.Path == "/install-container-agent.sh" || req.URL.Path == "/install-container-agent.sh" ||
req.URL.Path == "/install-host-agent.sh" || path.Clean(req.URL.Path) == "/install-host-agent.sh" ||
req.URL.Path == "/install-host-agent.ps1" || path.Clean(req.URL.Path) == "/install-host-agent.ps1" ||
req.URL.Path == "/uninstall-host-agent.sh" || path.Clean(req.URL.Path) == "/uninstall-host-agent.sh" ||
req.URL.Path == "/uninstall-host-agent.ps1" { path.Clean(req.URL.Path) == "/uninstall-host-agent.ps1" {
// Use the mux for API and special routes // Use the mux for API and special routes
r.mux.ServeHTTP(w, req) r.mux.ServeHTTP(w, req)
} else { } else {