mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-08-11 12:51:24 +00:00
76b54e7de4
The upload example wrote each uploaded file using the filename supplied verbatim in the multipart Content-Disposition header. A client could set that filename to an absolute path or one containing "../" components and cause the server to create or overwrite files outside the working directory. Reduce each client-supplied filename to its base name and reject the request with 400 Bad Request if the result is empty, ".", "..", or still contains a path separator (including colon for Windows drive letters).