commit 0cc6dc08624db4f84d7fba5d65169b53930f0d61 parent d479b7717b7957804d817f9331805bb5fd5cff5a Author: Andrew Laack <andrew@laack.co> Date: Sun, 30 Aug 2026 16:53:47 -0500 Path trav fix Diffstat:
| M | learning/bin/main.ml | | | 21 | ++++++++++++++++++--- |
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/learning/bin/main.ml b/learning/bin/main.ml @@ -1,13 +1,28 @@ open Jingoo +let is_safe_path name = + String.length name > 0 + && String.for_all (fun c -> + (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') + || (c >= '0' && c <= '9') || c = '-' || c = '_') name + let () = Dream.run @@ Dream.logger @@ Dream.router [ - Dream.get "/course/:course_name/" (fun request -> Dream.html (Render.render_sidebar @@ Render.render_course_home (Dream.param request "course_name"))); - Dream.get "/course/:course_name/page/:page_name" (fun request -> Dream.html @@ Render.render_sidebar @@ Render.render_page (Dream.param request "course_name") (Dream.param request "page_name")); + Dream.get "/course/:course_name/" (fun request -> Dream.html (Render.render_sidebar @@ Render.render_course_home + (if is_safe_path (Dream.param request "course_name") then Dream.param request "course_name" else ""))); + + Dream.get "/course/:course_name/page/:page_name" (fun request -> Dream.html @@ Render.render_sidebar @@ Render.render_page + (if is_safe_path (Dream.param request "course_name") then Dream.param request "course_name" else "") + + (if is_safe_path (Dream.param request "page_name") then (Dream.param request "page_name") else "")); + Dream.get "/static/**" (Dream.static "./static"); Dream.get "/" (fun _ -> Dream.html (Render.render_sidebar @@ Render.render_course_list)); + Dream.get "/course/:course_name/page/assets/**" (fun request -> Dream.static - (Shared.course_dir ^ (Dream.param request "course_name") ^ "/assets") request); + (Shared.course_dir ^ + (if is_safe_path (Dream.param request "course_name") then Dream.param request "course_name" else "") + ^ "/assets") request); ]