pathutil

Documentation

Overview

Package pathutil holds internal helpers for safely handling request and file paths. It is internal so it can be shared between the echo package and the middleware package without becoming part of the public API.

Index

• func HasEncodedPathSeparator(s string) bool

Functions

func HasEncodedPathSeparator

func HasEncodedPathSeparator(s string) bool

HasEncodedPathSeparator reports whether s contains a percent-encoded path separator, case-insensitively: %2F/%2f (forward slash) or %5C/%5c (backslash). Backslash is included as defense-in-depth against Windows-style separators even though fs.FS itself only uses forward slashes.

Such sequences let an attacker smuggle a separator past the router, which by default matches on the raw encoded path, so they must be rejected before unescaping when resolving static files.