@@ -11,7 +11,6 @@ import (
1111 "net/url"
1212 "os"
1313 "path/filepath"
14- "regexp"
1514 "strconv"
1615 "strings"
1716 "sync"
@@ -322,8 +321,8 @@ func (p *Server) Register(route *Route) error {
322321 if route == nil {
323322 return ErrNilRoute
324323 }
325- if ! isValidPath (route .Path ) {
326- return newDynamicError (ErrInvalidPath , fmt . Sprintf ( "'%s'" , route . Path ))
324+ if err := checkPath (route .Path ); err != nil {
325+ return newDynamicError (ErrInvalidPath , err . Error ( ))
327326 }
328327 if route .Method == "" {
329328 return ErrNoMethod
@@ -400,6 +399,10 @@ func (p *Server) Delete(route *Route) error {
400399}
401400
402401// Call makes a request to the parrot server
402+ // The method is the HTTP method to use (GET, POST, PUT, DELETE, etc.)
403+ // The path is the URL path to call
404+ // The response is returned as a resty.Response
405+ // Errors are returned if the server is shut down or if the request fails, not if the response is an error
403406func (p * Server ) Call (method , path string ) (* resty.Response , error ) {
404407 if p .shutDown {
405408 return nil , ErrServerShutdown
@@ -491,7 +494,7 @@ func (p *Server) dynamicHandler(w http.ResponseWriter, r *http.Request) {
491494
492495 route , err := p .cage .getRoute (r .URL .Path , r .Method )
493496 if err != nil {
494- if errors .Is (err , ErrRouteNotFound ) {
497+ if errors .Is (err , ErrRouteNotFound ) || errors . Is ( err , ErrCageNotFound ) {
495498 http .Error (w , "Route not found" , http .StatusNotFound )
496499 dynamicLogger .Debug ().Msg ("Route not found" )
497500 return
@@ -754,36 +757,58 @@ func (p *Server) loggingMiddleware(next http.Handler) http.Handler {
754757 return h (accessHandler (next ))
755758}
756759
757- var validPathRegex = regexp .MustCompile (`^\/[a-zA-Z0-9\-._~%!$&'()+,;=:@\/]` )
758-
759- func isValidPath (path string ) bool {
760+ func checkPath (path string ) error {
760761 switch path {
761762 case "" , "/" , "//" , healthRoute , recordRoute , routesRoute , "/.." :
762- return false
763+ return fmt . Errorf ( "cannot match special paths: '%s'" , path )
763764 }
764765 if strings .Contains (path , "/.." ) {
765- return false
766+ return fmt . Errorf ( "cannot match parent directory traversal: '%s'" , path )
766767 }
767768 if strings .Contains (path , "/." ) {
768- return false
769+ return fmt . Errorf ( "cannot match hidden files: '%s'" , path )
769770 }
770771 if strings .Contains (path , "//" ) {
771- return false
772+ return fmt . Errorf ( "cannot match double slashes: '%s'" , path )
772773 }
773774 if ! strings .HasPrefix (path , "/" ) {
774- return false
775+ return fmt . Errorf ( "path must start with a forward slash: '%s'" , path )
775776 }
776777 if strings .HasSuffix (path , "/" ) {
777- return false
778+ return fmt . Errorf ( "path cannot end with a forward slash: '%s'" , path )
778779 }
779780 if strings .HasPrefix (path , recordRoute ) {
780- return false
781+ return fmt . Errorf ( "cannot match record route: '%s'" , path )
781782 }
782783 if strings .HasPrefix (path , healthRoute ) {
783- return false
784+ return fmt . Errorf ( "cannot match health route: '%s'" , path )
784785 }
785786 if strings .HasPrefix (path , routesRoute ) {
786- return false
787+ return fmt .Errorf ("cannot match routes route: '%s'" , path )
788+ }
789+ match , err := filepath .Match (path , healthRoute )
790+ if err != nil {
791+ return fmt .Errorf ("failed to match: '%s'" , path )
792+ }
793+ if match {
794+ return fmt .Errorf ("cannot match health route: '%s'" , path )
795+ }
796+
797+ match , err = filepath .Match (path , recordRoute )
798+ if err != nil {
799+ return fmt .Errorf ("failed to match: '%s'" , path )
787800 }
788- return validPathRegex .MatchString (path )
801+ if match {
802+ return fmt .Errorf ("cannot match record route: '%s'" , path )
803+ }
804+
805+ match , err = filepath .Match (path , routesRoute )
806+ if err != nil {
807+ return fmt .Errorf ("failed to match: '%s'" , path )
808+ }
809+ if match {
810+ return fmt .Errorf ("cannot match routes route: '%s'" , path )
811+ }
812+
813+ return nil
789814}
0 commit comments