Subject: Really fix directory traversal Author: Christoph Biedl Forwarded: https://github.com/openfibernet/tftp-proxy/pull/3 Date: 2024-02-08 --- a/main.go +++ b/main.go @@ -18,7 +18,7 @@ // readHandler is called when client starts file download from server func readHandler(filename string, rf io.ReaderFrom) error { - file_path := filepath.Clean(path.Join(dir, filename)) + file_path := path.Join(dir, filepath.Clean(path.Join("/", filename))) if _, err := os.Stat(file_path); err == nil { file, err := os.Open(file_path)