Bug Fix: Directory Traversal

labstack · Dec 13, 2020 · c6541da · c6541da
1 parent 2b36b3d
commit c6541da
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/echo.go b/echo.go
@@ -53,6 +53,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"runtime"
+	"strings"
 	"sync"
 	"time"
 
@@ -487,6 +488,10 @@ func (common) static(prefix, root string, get func(string, HandlerFunc, ...Middl
 		}
 
 		name := filepath.Join(root, path.Clean("/"+p)) // "/"+ for security
+		// Prevent directory traversal
+		if !strings.HasPrefix(name+string(filepath.Separator), path.Clean(root)+string(filepath.Separator)) {
+			return ErrForbidden
+		}
 		fi, err := os.Stat(name)
 		if err != nil {
 			// The access path does not exist