From 2f0f3d45f4335327c269a689fbeb62b3003695aa Mon Sep 17 00:00:00 2001
From: la_ninpre <aaoth@aaoth.xyz>
Date: Wed, 28 Jan 2026 11:30:03 +0300
Subject: static files: allow files in a subdirectory

allowing '/' in paths is a bit scary, but
replacing the check with reject on '..' seems to work.

please correct me if i'm wrong and this is insecure.
---
 data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'data.c')

diff --git a/data.c b/data.c
index 27825ad..02686e1 100644
--- a/data.c
+++ b/data.c
@@ -2691,7 +2691,7 @@ static int _load_raw_file(const char *fn, xs_val **data, int *size,
 xs_str *_static_fn(snac *snac, const char *id)
 /* gets the filename for a static file */
 {
-    if (strchr(id, '/'))
+    if (strstr(id, ".."))
         return NULL;
     else
         return xs_fmt("%s/static/%s", snac->basedir, id);
-- 
cgit