do not expose web server filenames (#19925)
do not return back the absolute filename of files requested via the web server
Costa Tsaousis committed
Mar 20, 2025 at 20:29 UTC
968bc5df9a91afe27a5401088be19c683eafdd54
1 file changed
+3
-3
src/web/server/web_client.c
+3
-3
@@ -457,7 +457,7 @@ static int web_server_static_file(struct web_client *w, char *filename) {
457
if(!find_filename_to_serve(filename, web_filename, FILENAME_MAX, &statbuf, w, &is_dir)) {
458
w->response.data->content_type = CT_TEXT_HTML;
459
buffer_strcat(w->response.data, "File does not exist, or is not accessible: ");
460
- buffer_strcat_htmlescape(w->response.data, web_filename);
460
+ buffer_strcat_htmlescape(w->response.data, filename);
461
return HTTP_RESP_NOT_FOUND;
462
}
463
@@ -488,14 +488,14 @@ static int web_server_static_file(struct web_client *w, char *filename) {
488
w->response.data->content_type = CT_TEXT_HTML;
489
buffer_sprintf(w->response.header, "Location: /%s\r\n", filename);
490
buffer_strcat(w->response.data, "File is currently busy, please try again later: ");
491
- buffer_strcat_htmlescape(w->response.data, web_filename);
491
+ buffer_strcat_htmlescape(w->response.data, filename);
492
return HTTP_RESP_REDIR_TEMP;
493
}
494
else {
495
netdata_log_error("%llu: Cannot open file '%s'.", w->id, web_filename);
496
w->response.data->content_type = CT_TEXT_HTML;
497
buffer_strcat(w->response.data, "Cannot open file: ");
498
- buffer_strcat_htmlescape(w->response.data, web_filename);
498
+ buffer_strcat_htmlescape(w->response.data, filename);
499
return HTTP_RESP_NOT_FOUND;
500
}
501
}