Deny any directory traversal paths. README update

README.md

@@ -3,13 +3,16 @@
 Ramsey Kant
 https://github.com/RamseyK/httpserver
 
-A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool
+A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool on BSD systems
 
 ## Features
 * Clean, documented code
 * Efficient socket management with kqueue
 * Easy to understand HTTP protocol parser (from my ByteBuffer project)
 * Tested on FreeBSD and MacOS
 
+## Compiling Notes
+* On FreeBSD, compile with gmake
+
 ## License
 See LICENSE.TXT

src/HTTPServer.cpp

@@ -440,7 +440,7 @@ void HTTPServer::handleRequest(Client *cl, HTTPRequest* req) {
 	std::cout << "[" << cl->getClientIP() << "] " << req->methodIntToStr(req->getMethod()) << " " << req->getRequestUri() << std::endl;
 	/*std::cout << "Headers:" << std::endl;
 	for(int i = 0; i < req->getNumHeaders(); i++) {
-		std::cout << req->getHeaderStr(i) << std::endl;
+		std::cout << "\t" << req->getHeaderStr(i) << std::endl;
 	}
 	std::cout << std::endl;*/
 

src/ResourceHost.cpp

@@ -183,6 +183,9 @@ Resource* ResourceHost::getResource(std::string uri) {
 	if (uri.length() > 255 || uri.empty())
 		return NULL;
 
+	if (uri.find("../") != std::string::npos)
+		return NULL;
+
 	std::string path = baseDiskPath + uri;
 	Resource* res = NULL;