neerolyte/repoproxy — Issue #24: White list paths
Author: neerolyte
Created: 2011-10-21 14:58:41+00:00
State: open
Labels: bug

White listing has to occur both for what's being sent upstream and requested locally.

E.g. this shouldn't get through:
$ curl -s http://localhost:4321/../../../../../../../etc/hosts | head -1
127.0.0.1	localhost