Protect static file routes from directory traversal attacks.

[drgrice1]

Currently using a URL like
http://baseURL/../../../../../../../../../../../../../../../../etc/passwd returns the file /etc/passwd. That of course is a security vulnerability that should not happen.

This was recently discovered and fixed for webwork2, and basically the same solution is used to fix it here.

Below is a minimal script that can be used to test this:

use Mojo::Base -strict;
use Mojo::UserAgent;

my $server = 'http://localhost:3001';

my $ua  = Mojo::UserAgent->new;
my $res = $ua->get("$server/../../../../../../../../../../../../../../../../etc/passwd")->result;

if    ($res->is_success)  { say 'success'; say $res->body }
elsif ($res->is_error)    { say 'error'; say $res->message }
elsif ($res->code == 301) { say '301'; say $res->headers->location }
else                      { say 'Whatever...' }

Mojo::IOLoop->start unless Mojo::IOLoop->is_running;

Set $server to the URL of your renderer including the $baseURL.

With the develop branch the above script will output "success" followed by the contents of the /etc/passwd file on your server. With this branch it will output "error" followed by "Not found".

[drgrice1]

This needed a change. I realized the realpath approach wasn't going to work. PG creates symbolic links to static assets, and so the realpath of those links will not be a subdirectory of the temporary directory. So instead a path_is_subdir using canonpath like the same method from webwork2 is used.

[somiaj]

This now needs to be rebased since I merged the name change.