Merge pull request #2 from jtgeibel/normalize-paths

Normalize paths

Author: jtgeibel

src/lib.rs

@@ -5,6 +5,7 @@ mod tests;
 
 use std::io::{Cursor, Read};
 use std::net::SocketAddr;
+use std::path::{Component, Path, PathBuf};
 use std::sync::Arc;
 
 use futures::{future, Future, Stream};
@@ -64,6 +65,7 @@ impl Parts {
 
 struct ConduitRequest {
     parts: Parts,
+    path: String,
     body: Cursor<Chunk>,
     extensions: conduit::Extensions,
 }
@@ -122,7 +124,7 @@ impl conduit::Request for ConduitRequest {
     }
 
     fn path(&self) -> &str {
-        &self.parts.0.uri.path()
+        &*self.path
     }
 
     fn extensions(&self) -> &conduit::Extensions {
@@ -158,8 +160,33 @@ impl conduit::Request for ConduitRequest {
 
 impl ConduitRequest {
     fn new(parts: Parts, body: Chunk) -> ConduitRequest {
+        let path = parts.0.uri.path().to_string();
+        let path = Path::new(&path);
+        let path = path
+            .components()
+            .fold(PathBuf::new(), |mut result, p| match p {
+                Component::Normal(x) => {
+                    if x != "" {
+                        result.push(x)
+                    };
+                    result
+                }
+                Component::ParentDir => {
+                    result.pop();
+                    result
+                }
+                Component::RootDir => {
+                    result.push(Component::RootDir);
+                    result
+                }
+                _ => result,
+            })
+            .to_string_lossy()
+            .to_string(); // non-Unicode is replaced with U+FFFD REPLACEMENT CHARACTER
+
         ConduitRequest {
             parts,
+            path,
             body: Cursor::new(body),
             extensions: conduit::Extensions::new(),
         }

src/tests.rs

@@ -56,6 +56,17 @@ impl Handler for InvalidStatus {
     }
 }
 
+struct AssertPathNormalized;
+impl Handler for AssertPathNormalized {
+    fn call(&self, req: &mut Request) -> Result<Response, Box<Error + Send>> {
+        if req.path() == "/normalized" {
+            OkResult.call(req)
+        } else {
+            ErrorResult.call(req)
+        }
+    }
+}
+
 fn build_headers(msg: &str) -> HashMap<String, Vec<String>> {
     let mut headers = HashMap::new();
     headers.insert("ok".into(), vec![msg.into()]);
@@ -106,3 +117,24 @@ fn err_responses() {
 fn recover_from_panic() {
     assert_generic_err(simulate_request(Panic));
 }
+
+#[test]
+fn normalize_path() {
+    use hyper::service::{NewService, Service};
+
+    let new_service = super::Service::new(AssertPathNormalized, 1);
+    let mut service = new_service.new_service().wait().unwrap();
+    let req = hyper::Request::put("//removed/.././.././normalized")
+        .body(hyper::Body::default())
+        .unwrap();
+    let resp = service.call(req).wait().unwrap();
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.headers().len(), 1);
+
+    let req = hyper::Request::put("//normalized")
+        .body(hyper::Body::default())
+        .unwrap();
+    let resp = service.call(req).wait().unwrap();
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.headers().len(), 1);
+}