better asset check

Author: ThomasTJdev

nimletter.nimble

@@ -1,6 +1,6 @@
 # Package
 
-version       = "0.8.3"
+version       = "0.8.4"
 author        = "ThomasTJdev"
 description   = "Newsletter"
 license       = "AGPL v3"

src/routes/routes_assets.nim

@@ -28,9 +28,9 @@ proc(request: Request) =
 
   acquire(gFilecacheLock)
 
-  # if not assets.hasKey(path):
-  #   release(gFilecacheLock)
-  #   resp Http404
+  if path notin approvedPaths:
+    release(gFilecacheLock)
+    resp Http404
 
   var headers: HttpHeaders
   {.gcsafe.}:

src/utils/assets.nim

@@ -19,5 +19,11 @@ proc embed(directory: string): Table[string, tuple[filedata: string, ext: string
     echo fd
   return result
 
+proc pathCheck(assets: Table[string, tuple[filedata: string, ext: string]]): seq[string] =
+  for path in assets.keys():
+    result.add(path)
+  return result
+
 const assets* = embed("assets")
+const approvedPaths* = pathCheck(assets)
 let m* = newMimetypes()