Path traversal in GET requests

[ihawp]

In http.c:

int send_stream_file(
	int *client_fd,
	HTTPRequest *http_request,
	HTTPResponse *http_response
) {
	if (strcmp(http_request->path, "/") == 0) {
		strcpy(http_request->path, "index.html");
	}

	...
	char public_path[PATH_SIZE];
	snprintf(public_path, PATH_SIZE, "public/%s", http_request->path); <-- Printing the path directly 
															  without checks for '../' or './' or '<n>../../'
	...

[ihawp]

Need to reconstruct the path

[ihawp]

Currently, path validity is only ever determined during GET requests, when a resource is unable to be located in the public/ directory. This part will be easily solved by moving the decode_url(...) and sanitize_path(...) calls outside the handle_get_request(...) function, or by calling them in their own time on each METHOD route.

If you make a POST request to the server with an invalid path like: curl localhost:3000// -X POST --path-as-is (like in curl.sh) the request will succeed.

Though it is worth noting that at this point in time the server responds with a success message to any successfully retrieved data.