The ronin-web server command currently displays the normalized request path, not the raw request path.
$ curl --path-as-is 'http://localhost:8000/../../../foo'
$ ronin-web server
* Listening on http://0.0.0.0:8000
Use Ctrl-C to stop
GET /foo
Host: localhost:8000
User-Agent: curl/8.6.0
Accept: */*
Version: HTTP/1.1
$ nc -l -p 8000
GET /../../../foo HTTP/1.1
Host: localhost:8000
User-Agent: curl/8.6.0
Accept: */*
This appears to be due to Rack normalizing the path at some point. We need to change the printing logic in Ronin::Web::CLI::Commands::Server#run to display the raw request path without any normalization.
The
ronin-web servercommand currently displays the normalized request path, not the raw request path.This appears to be due to Rack normalizing the path at some point. We need to change the printing logic in
Ronin::Web::CLI::Commands::Server#runto display the raw request path without any normalization.