From 51e4106d1d3dd6bc543aa81e26e79aa10bb49763 Mon Sep 17 00:00:00 2001 From: Arve Knudsen Date: Fri, 9 Apr 2021 11:49:38 +0200 Subject: [PATCH] API: Fix paths starting with double leading slash or slash and backslash (#32830) * API: Fix paths starting with double leading slash or slash and backslash Signed-off-by: Arve Knudsen --- pkg/api/static/static.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/api/static/static.go b/pkg/api/static/static.go index 857df64b621..6381262fb4e 100644 --- a/pkg/api/static/static.go +++ b/pkg/api/static/static.go @@ -22,6 +22,7 @@ import ( "os" "path" "path/filepath" + "regexp" "strings" "sync" @@ -154,6 +155,10 @@ func staticHandler(ctx *macaron.Context, log *log.Logger, opt StaticOptions) boo if !strings.HasPrefix(path, "/") { // Disambiguate that it's a path relative to this server path = fmt.Sprintf("/%s", path) + } else { + // A string starting with // or /\ is interpreted by browsers as a URL, and not a server relative path + rePrefix := regexp.MustCompile(`^(?:/\\|/+)`) + path = rePrefix.ReplaceAllString(path, "/") } http.Redirect(ctx.Resp, ctx.Req.Request, path, http.StatusFound) return true