Fix to address directory traversal #2

.github/workflows/go.yml

@@ -0,0 +1,28 @@
+# This workflow will build a golang project
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
+
+name: Go
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+jobs:
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: '1.20'
+
+    - name: Build
+      run: go build -v ./...
+
+    - name: Test
+      run: go test -v ./...

.github/workflows/goreleaser.yml

@@ -0,0 +1,30 @@
+name: goreleaser
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v5
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yml

@@ -1,26 +1,44 @@
-env:
-  - GO111MODULE=on
-  - GOPROXY=https://gocenter.io
+# This is an example .goreleaser.yml file with some sensible defaults.
+# Make sure to check the documentation at https://goreleaser.com
+
+# The lines bellow are called `modelines`. See `:help modeline`
+# Feel free to remove those if you don't want/need to use them.
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj
+
 before:
   hooks:
-    - go mod tidy
+    - go mod download
+
 builds:
-- env:
-  - CGO_ENABLED=0
+  - env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+
 archives:
-- replacements:
-    darwin: Darwin
-    linux: Linux
-    windows: Windows
-    386: i386
-    amd64: x86_64
+  - format: tar.gz
+    # this name template makes the OS and Arch compatible with the results of `uname`.
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    # use zip for windows archives
+    format_overrides:
+      - goos: windows
+        format: zip
+
 checksum:
   name_template: 'checksums.txt'
-snapshot:
-  name_template: "{{ .Tag }}-next"
+
 changelog:
   sort: asc
   filters:
     exclude:
-    - '^docs:'
-    - '^test:'
+      - "^docs:"
+      - "^test:"

main.go

@@ -4,10 +4,10 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"path"
+	"path/filepath"
 	"time"
 
 	"github.com/pin/tftp"
@@ -18,9 +18,10 @@ var dir string
 
 // readHandler is called when client starts file download from server
 func readHandler(filename string, rf io.ReaderFrom) error {
+	file_path := path.Join(dir, filepath.Clean(path.Join("/", filename)))
 
-	if _, err := os.Stat(path.Join(dir, filename)); err == nil {
-		file, err := os.Open(path.Join(dir, filename))
+	if _, err := os.Stat(file_path); err == nil {
+		file, err := os.Open(file_path)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "%v\n", err)
 			return err
@@ -41,7 +42,7 @@ func readHandler(filename string, rf io.ReaderFrom) error {
 
 		fmt.Printf("%s %d bytes sent\n", filename, n)
 	} else { // File not found locally. Proxying the request.
-		fileUrl := url + "/" + filename
+		fileUrl := url + filepath.Clean(path.Join("/", filename))
 		resp, err := http.Get(fileUrl)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "%v\n", err)
@@ -50,8 +51,8 @@ func readHandler(filename string, rf io.ReaderFrom) error {
 		defer resp.Body.Close()
 
 		if resp.StatusCode != 200 {
-			io.Copy(ioutil.Discard, resp.Body)
-			return fmt.Errorf("Received status code: %d", resp.StatusCode)
+			io.Copy(io.Discard, resp.Body)
+			return fmt.Errorf("received status code: %d", resp.StatusCode)
 		}
 
 		rf.(tftp.OutgoingTransfer).SetSize(resp.ContentLength)