From 2f0f3d45f4335327c269a689fbeb62b3003695aa Mon Sep 17 00:00:00 2001
From: la_ninpre <aaoth@aaoth.xyz>
Date: Wed, 28 Jan 2026 11:30:03 +0300
Subject: static files: allow files in a subdirectory

allowing '/' in paths is a bit scary, but
replacing the check with reject on '..' seems to work.

please correct me if i'm wrong and this is insecure.
---
 html.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'html.c')

diff --git a/html.c b/html.c
index 7b93e49..2a03579 100644
--- a/html.c
+++ b/html.c
@@ -5026,7 +5026,7 @@ int html_get_handler(const xs_dict *req, const char *q_path,
     }
     else
     if (xs_startswith(p_path, "s/")) { /** a static file **/
-        xs *l    = xs_split(p_path, "/");
+        xs *l    = xs_split_n(p_path, "/", 1);
         const char *id = xs_list_get(l, 1);
         int sz;
 
-- 
cgit