diff --git a/gateway/core/corehttp/gateway_indexPage.go b/gateway/core/corehttp/gateway_indexPage.go index 4485c84e6..366c99aca 100644 --- a/gateway/core/corehttp/gateway_indexPage.go +++ b/gateway/core/corehttp/gateway_indexPage.go @@ -2,6 +2,7 @@ package corehttp import ( "html/template" + "net/url" "path" "strings" @@ -45,6 +46,12 @@ func init() { return "ipfs-" + ext[1:] // slice of the first dot } + // custom template-escaping function to escape a full path, including '#' and '?' + urlEscape := func(rawUrl string) string { + pathUrl := url.URL{Path: rawUrl} + return pathUrl.String() + } + // Directory listing template dirIndexBytes, err := assets.Asset(assetPath + "dir-index.html") if err != nil { @@ -53,5 +60,6 @@ func init() { listingTemplate = template.Must(template.New("dir").Funcs(template.FuncMap{ "iconFromExt": iconFromExt, + "urlEscape": urlEscape, }).Parse(string(dirIndexBytes))) } diff --git a/gateway/core/corehttp/gateway_test.go b/gateway/core/corehttp/gateway_test.go index 551fbf6f5..5479830d3 100644 --- a/gateway/core/corehttp/gateway_test.go +++ b/gateway/core/corehttp/gateway_test.go @@ -261,7 +261,7 @@ func TestIPNSHostnameBacklinks(t *testing.T) { t.Fatal(err) } dagn2.AddNodeLink("bar", dagn3) - dagn1.AddNodeLink("foo", dagn2) + dagn1.AddNodeLink("foo? #<'", dagn2) if err != nil { t.Fatal(err) } @@ -279,7 +279,7 @@ func TestIPNSHostnameBacklinks(t *testing.T) { ns["/ipns/example.net"] = path.FromString("/ipfs/" + k.String()) // make request to directory listing - req, err := http.NewRequest("GET", ts.URL+"/foo/", nil) + req, err := http.NewRequest("GET", ts.URL+"/foo%3F%20%23%3C%27/", nil) if err != nil { t.Fatal(err) } @@ -298,13 +298,13 @@ func TestIPNSHostnameBacklinks(t *testing.T) { s := string(body) t.Logf("body: %s\n", string(body)) - if !strings.Contains(s, "Index of /foo/") { + if !strings.Contains(s, "Index of /foo? #<'/") { t.Fatalf("expected a path in directory listing") } if !strings.Contains(s, "") { t.Fatalf("expected backlink in directory listing") } - if !strings.Contains(s, "") { + if !strings.Contains(s, "") { t.Fatalf("expected file in directory listing") } @@ -339,7 +339,7 @@ func TestIPNSHostnameBacklinks(t *testing.T) { } // make request to directory listing - req, err = http.NewRequest("GET", ts.URL+"/foo/bar/", nil) + req, err = http.NewRequest("GET", ts.URL+"/foo%3F%20%23%3C%27/bar/", nil) if err != nil { t.Fatal(err) } @@ -358,13 +358,13 @@ func TestIPNSHostnameBacklinks(t *testing.T) { s = string(body) t.Logf("body: %s\n", string(body)) - if !strings.Contains(s, "Index of /foo/bar/") { + if !strings.Contains(s, "Index of /foo? #<'/bar/") { t.Fatalf("expected a path in directory listing") } - if !strings.Contains(s, "") { + if !strings.Contains(s, "") { t.Fatalf("expected backlink in directory listing") } - if !strings.Contains(s, "") { + if !strings.Contains(s, "") { t.Fatalf("expected file in directory listing") }