Skip to content

fix(http): handle static directory paths safely - #4053

Open
nik-7-alt wants to merge 10 commits into
gofr-dev:mainfrom
nik-7-alt:fix/http-method-not-allowed
Open

fix(http): handle static directory paths safely#4053
nik-7-alt wants to merge 10 commits into
gofr-dev:mainfrom
nik-7-alt:fix/http-method-not-allowed

Conversation

@nik-7-alt

@nik-7-alt nik-7-alt commented Aug 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Description:

  • Fixed static file directory boundary checking in isWithinDirectory.
  • Normalized and cleaned both the configured static directory and requested file path before comparison.
  • Ensures files inside the static directory, including nested files, are correctly served.
  • Prevents sibling directories with shared prefixes from being incorrectly treated as part of the static directory.
  • Correctly handles requests for the static directory itself.
  • No new dependencies were added.

Breaking Changes (if applicable):

  • None.

Additional Information:

  • The implementation uses filepath.Clean and filepath.ToSlash for platform-independent path normalization.
  • Code was formatted using gofmt.
  • Targeted test executed successfully:
    go test ./pkg/gofr/http -run Test_isRestrictedFile -v
  • All cases in Test_isRestrictedFile passed successfully.
  • The broader static-file test suite was also executed. The remaining permission-denied failures are due to Unix permission semantics (0000) not being enforced equivalently on Windows.

Checklist:

  • I have formatted my code using gofmt.
  • All new code is covered by unit tests.
  • This PR does not decrease the overall code coverage.
  • I have reviewed the code comments and documentation for clarity.

akshat-kumar-singhal and others added 10 commits August 13, 2026 21:33
@akshat-kumar-singhal
Merge pull request gofr-dev#3815 from akshat-kumar-singhal/fix/flaky-…
8a28c9c 
…cron-nil-logger-sql-mock-3813

fix(cron): join in-flight jobs on Stop and skip jobs with no logger
@akshat-kumar-singhal @aryanmehrotra
chore(ci): pin ls-lint/action to node24 commit to clear Node 20 warni…
bc271ff 
…ng (gofr-dev#3864)

v2.3.1 declares `using: node20`, so every Linting Party run emits the
Node.js 20 deprecation warning. Upstream fixed it in 0c7f19c ("chore: run
on the node24 runtime"), but no release carries it yet, so pin the SHA.
Revert to a tag once ls-lint cuts a release with the node24 runtime.

Co-authored-by: Aryan Mehrotra <aryanmehrotra2000@gmail.com>
@akshat-kumar-singhal
fix(grpc): guard the server handle so Run and Shutdown stop racing (g…
aef1622 
…ofr-dev#3929) (gofr-dev#3931)
@akshat-kumar-singhal @aryanmehrotra
chore(ci): build the website workflows on Node 24 instead of EOL Node…
9a9ea85 
… 18 (gofr-dev#3870) (gofr-dev#3871)

Node 18 "Hydrogen" reached end-of-life on 2025-04-30 and receives no
security patches, including for the bundled OpenSSL and undici. The
prod and stage website workflows build and deploy gofr.dev — they run
`yarn install --frozen-lockfile` and `yarn refresh-data` against the
network while holding the GAR deployment key and `packages: write`.

Targets 24.x rather than the 22.x the issue suggested: v22 has been in
maintenance since 2025-10-21 while v24 is the Active LTS through
2028-04-30. Verified `yarn install --frozen-lockfile` is green on
node:24-alpine against the website's current lockfile.

Both files changed together so prod and stage don't drift.

Co-authored-by: Aryan Mehrotra <aryanmehrotra2000@gmail.com>
@akshat-kumar-singhal
fix(examples): wait on a readiness signal instead of sleeping, and ma…
7c0fad4 
…ke using-migrations self-contained (gofr-dev#3818, gofr-dev#3816) (gofr-dev#3821)
@aryanmehrotra
feat(ai): add Embed capability to the LLM (gofr-dev#3757)
f1e5c1a
@aryanmehrotra
perf(http): opt-in O(1) trie router behind GOFR_ROUTER (gofr-dev#3759)
878b026
@Umang01-hash
chore(deps): consolidate minor/patch dependency updates (2026-08-18) (g…
467b2ff 
…ofr-dev#3969)
@akshat-kumar-singhal
fix(ci): wait for Example-Unit-Testing services to be ready, and pin …
24d51d6 
…Zipkin (gofr-dev#3868) (gofr-dev#3939)
@nik-7-alt
fix(http): handle static directory paths safely
912d37b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@nik-7-alt @akshat-kumar-singhal @aryanmehrotra @Umang01-hash