From 9f42ccd6399d604a49a36cdf91a4221b85f0d138 Mon Sep 17 00:00:00 2001
From: DexesTTP <dexes.ttp@gmail.com>
Date: Tue, 18 May 2021 08:58:37 +0200
Subject: [PATCH] WebServer: Fix jailbreaking of server via .. relative paths

The recent patch to LexicalPath allowed relative paths like ../ to work
in requests to WebServer. This wasn't too dangerous because of unveil,
but let's still fix this :^)
---
 Userland/Services/WebServer/Client.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Userland/Services/WebServer/Client.cpp b/Userland/Services/WebServer/Client.cpp
index 21dc041a69..3c839ce72a 100644
--- a/Userland/Services/WebServer/Client.cpp
+++ b/Userland/Services/WebServer/Client.cpp
@@ -73,7 +73,7 @@ void Client::handle_request(ReadonlyBytes raw_request)
         return;
     }
 
-    auto requested_path = LexicalPath::canonicalized_path(request.resource());
+    auto requested_path = LexicalPath::join("/", request.resource()).string();
     dbgln("Canonical requested path: '{}'", requested_path);
 
     StringBuilder path_builder;