static: clean the path URL before redirecting

[humaidq]

This prevents a malicious redirect with a crafted URL. Resolves #198.

It prevents links such as:
http://localhost:4000/%2fhumaidq.ae%2f..
http://localhost:4000//humaidq.ae%2f..
from giving a 302 Found redirecting to humaidq.ae

[codecov]

Codecov Report

Merging #199 into master will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master     #199   +/-   ##
=======================================
  Coverage   91.77%   91.77%           
=======================================
  Files          11       11           
  Lines        1556     1557    +1     
=======================================
+ Hits         1428     1429    +1     
  Misses         96       96           
  Partials       32       32           

Impacted Files	Coverage Δ
static.go	90.00% <100.00%> (+0.08%)	⬆️

[unknwon]

Thanks for the PR! But I am not confident this is the right change to fix #198.

I think we should instead do this on line 126 (not verified):

-file := ctx.Req.URL.Path
+file := path.Clean(ctx.Req.URL.Path)

Besides, can you add some tests to catch this case?

[unknwon]

I can't see your reply here. Why path.Clean can't solve the problem? https://play.golang.org/p/AB5Ih30w0bc

[humaidq]

I don't know why it doesn't solve it. Let me push with the test and check it out.
Edit: https://github.com/go-macaron/macaron/pull/199/checks?check_run_id=638633200#step:4:884
Edit 2: My bad, realised what the issue was. Pushing a fix.

[unknwon]

Nice,

[unknwon]

Looks like the call of path.Clean here is ineffective and needless, so we can remove it.

[unknwon]

Sorry about noises 😅 Waiting for CI to merge.

[mattdavis90]

Hi, this seems to have started causing issues when StaticOptions.Prefix != "". The path.Clean call only ends in "/" when ctx.Req.URL.Path == "/" (or similar) which isn't the case if Prefix != "", hence you get into a redirect-spiral and no content can be served. Thanks

[humaidq]

Hello Matt, Could you please create this as an issue, including an example so I am able to reproduce your issue? Thank you.