CrowCpp / Crow

A Fast and Easy to use microframework for the web.
https://crowcpp.org
Other
3.31k stars 365 forks source link

set_static_file_info doesn't support file path with '-' symbol #886

Closed faywong closed 2 months ago

faywong commented 2 months ago

Take 8e6ab17f-170e-4b0a-9375-7b72f62870aa_pset_2024-09-01_13:33:45.xlsx as example, the fstat can't find the file.

after i removed the '-' in datetime part, it works as expected.

Is this intended by design?

gittiver commented 2 months ago

I would say - no.

faywong commented 2 months ago

More detail:

param path is "8e6ab17f-170e-4b0a-9375-7b72f62870aa_pset_2024-09-01_13_33_45.xlsx"

 /// Return a static file as the response body without sanitizing the path (use set_static_file_info instead)
        void set_static_file_info_unsafe(std::string path)
        {
            file_info.path = path;
            file_info.statResult = stat(file_info.path.c_str(), &file_info.statbuf); // here returns -1 and errno 2
#ifdef CROW_ENABLE_COMPRESSION
            compressed = false;
#endif
            if (file_info.statResult == 0 && S_ISREG(file_info.statbuf.st_mode))
            {
                std::size_t last_dot = path.find_last_of(".");
                std::string extension = path.substr(last_dot + 1);
                code = 200;
                this->add_header("Content-Length", std::to_string(file_info.statbuf.st_size));

                if (!extension.empty())
                {
                    this->add_header("Content-Type", get_mime_type(extension));
                }
            }
            else
            {
                code = 404;
                file_info.path.clear();
            }
        }

stat return -1, and errno 2, perror() prints No such file or directory

so i verity it with ls -l

ls -l 8e6ab17f-170e-4b0a-9375-7b72f62870aa_pset_2024-09-01_13\:33\:45.xlsx 
-rw-r--r-- 1 faywong faywong 167219  9月 3日 09:21 8e6ab17f-170e-4b0a-9375-7b72f62870aa_pset_2024-09-01_13:33:45.xlsx

ls -l 8e6ab17f-170e-4b0a-9375-7b72f62870aa_pset_2024-09-01_13_33_45.xlsx
ls: 无法访问 '8e6ab17f-170e-4b0a-9375-7b72f62870aa_pset_2024-09-01_13_33_45.xlsx': 没有那个文件或目录

the key point is the ":" which is invalid in linux file path and need to be escaped. It is my fault, sorry to bother you all.

Many thx for your great work!