diff --git a/.github/testdata/fs/css/test/style2.css b/.github/testdata/fs/css/test/style2.css new file mode 100644 index 00000000000..a0671e59a0e --- /dev/null +++ b/.github/testdata/fs/css/test/style2.css @@ -0,0 +1,3 @@ +h1 { + color: black; +} diff --git a/middleware/static/static.go b/middleware/static/static.go index bd7ab6fa9b3..4615c056126 100644 --- a/middleware/static/static.go +++ b/middleware/static/static.go @@ -23,6 +23,9 @@ import ( // It returns an error if the path attempts to traverse directories. func sanitizePath(p []byte, filesystem fs.FS) ([]byte, error) { var s string + + hasTrailingSlash := len(p) > 0 && p[len(p)-1] == '/' + if bytes.IndexByte(p, '\\') >= 0 { b := make([]byte, len(p)) copy(b, p) @@ -66,6 +69,10 @@ func sanitizePath(p []byte, filesystem fs.FS) ([]byte, error) { s = "/" + s } + if hasTrailingSlash && len(s) > 1 && s[len(s)-1] != '/' { + s += "/" + } + return utils.UnsafeBytes(s), nil } diff --git a/middleware/static/static_test.go b/middleware/static/static_test.go index fcadd3d4ed3..195b7999a87 100644 --- a/middleware/static/static_test.go +++ b/middleware/static/static_test.go @@ -651,6 +651,20 @@ func Test_Static_FS_Browse(t *testing.T) { require.NoError(t, err, "app.Test(req)") require.Contains(t, string(body), "color") + resp, err = app.Test(httptest.NewRequest(fiber.MethodGet, "/dirfs/test", nil)) + require.NoError(t, err, "app.Test(req)") + require.Equal(t, 200, resp.StatusCode, "Status code") + require.Equal(t, fiber.MIMETextHTMLCharsetUTF8, resp.Header.Get(fiber.HeaderContentType)) + + resp, err = app.Test(httptest.NewRequest(fiber.MethodGet, "/dirfs/test/style2.css", nil)) + require.NoError(t, err, "app.Test(req)") + require.Equal(t, 200, resp.StatusCode, "Status code") + require.Equal(t, fiber.MIMETextCSSCharsetUTF8, resp.Header.Get(fiber.HeaderContentType)) + + body, err = io.ReadAll(resp.Body) + require.NoError(t, err, "app.Test(req)") + require.Contains(t, string(body), "color") + resp, err = app.Test(httptest.NewRequest(fiber.MethodGet, "/embed", nil)) require.NoError(t, err, "app.Test(req)") require.Equal(t, 200, resp.StatusCode, "Status code")