• Dinis Rosário's avatar
    Fix remove_double_dots_and_double_slashes removing all the dots leading http... · 3bd79c7c
    Dinis Rosário authored
    Fix remove_double_dots_and_double_slashes removing all the dots leading http server to serve wrong URI
    
    If the uri is something like '/js/...jquery.js', remove_double_dots_and_double_slashes will remove the 3 dots and the http server will serves the /js/jquery.js file.
    remove_double_dots_and_double_slashes should check if a dot or double dots is followed by a slash (or backslash) and only remove this to avoid disclosure attack.
    3bd79c7c
mongoose.c 165 KB