Prevent directory traversal

tucksaun · tucksaun · commit 3a8d98944ec7 · 2023-02-23T15:41:17.000-05:00
diff --git a/local/php/envs.go b/local/php/envs.go
@@ -38,7 +38,7 @@ func (p *Server) generateEnv(req *http.Request) map[string]string {
 
 	pathInfo := req.URL.Path
 	if pos := strings.Index(strings.ToLower(pathInfo), ".php"); pos != -1 {
-		file := pathInfo[:pos+4]
+		file := filepath.Clean(pathInfo[:pos+4])
 		if _, err := os.Stat(filepath.Join(p.documentRoot, file)); err == nil {
 			scriptName = file
 			pathInfo = pathInfo[pos+4:]
