metsw24-max 8710fbd25d Refuse a ':' in a path a mount point serves on Windows (#2643) ...

On NTFS a ':' in a path names a stream of the file, so /dir/test.html::$DATA opened the default stream of dir/test.html and passed a set_pre_routing_handler() guard on /dir/test.html, and /setup.exe:Zone.Identifier served the stream Windows attaches to downloaded files. is_valid_path() now refuses a ':' on Windows.

Elsewhere a ':' is an ordinary file name character, so it is still served: a file such as 2024-01-01T10:00:00.log would otherwise answer 404. The test pins both sides.

2026-10-25 22:39:44 -04:00

1.0 MiB

Raw Blame History

View Raw