5 ms·

Very nice proof of concept. Just a word of warning: In practice you want to sanitize your input. The code in "Serving static files" allows to break out of docum

• brlewis 11y ago
  Have you tried to actually exploit that? I don't currently use Racket myself, but I would expect request-uri to prevent ".." and if it didn't surely url-path would. ; extract the URI from the request: (define uri (request-uri req)) ; extract the resource from the URI: (define resource (map path/param-path (url-path uri))) ; find the file location: (define file (string-append document-root "/" (string-join resource "/")))