jmcbray/germinal
2
1
Fork 1
Code Issues 5 Pull requests Releases Wiki Activity

Do not send a body for non success responses #17

New issue
Closed
opened 2020-06-13 15:17:43 -04:00 by tobias · 2 comments
tobias commented 2020-06-13 15:17:43 -04:00
Contributor
Copy link

The gemini spec says:

If does not belong to the "SUCCESS" range of codes, then the server MUST close the connection after sending the header and MUST NOT send a response body.

But gemini-serve-file-or-directory tries e.g. to return "Internal server error" which fails since it is a string and not octets

The gemini spec says: > If <STATUS> does not belong to the "SUCCESS" range of codes, then the server MUST close the connection after sending the header and MUST NOT send a response body. But gemini-serve-file-or-directory tries e.g. to return `"Internal server error"` which fails since it is a string and not octets
tobias commented 2020-06-13 15:32:26 -04:00
Author
Contributor
Copy link

Further testing shows, that .../...// is internally converted to ../ and thus files outside of the document root might be listed and also read if they have an extension recognized by mimes:mime

Further testing shows, that `.../...//` is internally converted to `../` and thus files outside of the document root might be listed and also read if they have an extension recognized by `mimes:mime`
jmcbray commented 2020-06-13 16:28:30 -04:00
Owner
Copy link

Fixed.

Fixed.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
routes
fix-min-ssl-version
config-file
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jmcbray/germinal#17
No description provided.