rust-embed

rust macro which loads files into the rust binary at compile time during release and loads the file from the fs during dev.

639ec4dc — Buckram

found better function

Files changed (1) hide show

impl/src/lib.rs CHANGED Viewed

@@ -143,11 +143,7 @@ fn dynamic(ident: &syn::Ident, folder_path: String, prefix: Option<&str>, includ
                   // Tried to request a path that is not in the embedded folder
                   // Should be allowed only if it was a symlink
-                  // TODO: Currently it allows "path_traversal_attack" for the symlink files
-                  // For it to be working properly we need to get absolute path first
-                  // and check that instead if it starts with `canonical_folder_path`
-                  // https://doc.rust-lang.org/std/path/fn.absolute.html (currently nightly)
-                  let metadata = ::std::fs::metadata(file_path.as_path()).ok()?;
+                  let metadata = ::std::fs::symlink_metadata(file_path.as_path()).ok()?;
                   if !metadata.is_symlink() {
                     return ::std::option::Option::None;
                   }