[tor-commits] [flashproxy/master] More careful path parsing.

[dcf at torproject.org]

commit 25919d46c1f9ef5c8b6c518c045ac6d07cbaa109
Author: David Fifield <david at bamsoftware.com>
Date:   Sun May 19 23:57:57 2013 -0700

    More careful path parsing.
---
 appengine/fp-reg.go |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/appengine/fp-reg.go b/appengine/fp-reg.go
index 2ba6f10..cb0fa04 100644
--- a/appengine/fp-reg.go
+++ b/appengine/fp-reg.go
@@ -3,6 +3,7 @@ package fp_reg
 import (
 	"net"
 	"net/http"
+	"path"
 
 	"appengine"
 	"appengine/urlfetch"
@@ -25,8 +26,12 @@ func ipHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func regHandler(w http.ResponseWriter, r *http.Request) {
+	dir, blob := path.Split(path.Clean(r.URL.Path))
+	if dir != "/reg/" {
+		http.NotFound(w, r)
+		return
+	}
 	c := appengine.NewContext(r)
-	blob := r.URL.Path[5:]
 	client := urlfetch.Client(c)
 	_, err := client.Get(BASE + blob)
 	if err != nil {