diff --git a/actix-files/src/path_buf.rs b/actix-files/src/path_buf.rs index 82b13e30..50b9677e 100644 --- a/actix-files/src/path_buf.rs +++ b/actix-files/src/path_buf.rs @@ -40,6 +40,7 @@ impl PathBufWrap { return Err(UriSegmentError::BadChar('/')); } + // disallow invalid or suspicious path segments for segment in path.split('/') { if segment == ".." { segment_count -= 1;