search

cs3org / wopiserver

A vendor-neutral application gateway compatible with the WOPI specifications.
Apache License 2.0
55 stars 26 forks source link

Improper URL concatenation #150

Closed DeepDiver1975 closed 5 months ago

DeepDiver1975 commented 5 months ago

https://github.com/cs3org/wopiserver/blob/b4b35d4a84bc4d497190df74d786409836ebe3d0/src/core/wopiutils.py#L181

Instead of string concatenation functions like urljoin or urlunsplit should be used to construct URLs to prevent double slashes which can lead to issues.

wopiurl as well as wopiproxy suffer from this issue when setup with a trailing slash.

glpatcern commented 5 months ago

Good catch, but rather than introducing urljoin that has some interesting side effects if (ever) wopiurl also includes a path (e.g. from reverse proxies), I have stripped the trailing slashes when reading the config - see PR. Would that be enough?