Make sure we have at least one folder seperation char
@@ -236,6 +236,8 @@ int http_response_sendfile2(http_response_s *response, http_request_s *request,
if (file_path_unsafe && path_unsafe_len == 0)
path_unsafe_len = strlen(file_path_unsafe);
+ if (!path_unsafe_len)
+ return -1;
const char *mime = NULL;
const char *ext = NULL;
@@ -253,7 +255,7 @@ int http_response_sendfile2(http_response_s *response, http_request_s *request,
fname[path_safe_len] = 0;
// if the last character is a '/', step back.
if (file_path_unsafe) {
- if (fname[path_safe_len - 1] == '/')
+ if (fname[path_safe_len - 1] == '/' && file_path_unsafe[0] == '/')
path_safe_len--;
ssize_t tmp = http_decode_path(fname + path_safe_len, file_path_unsafe,
path_unsafe_len);
