diff --git a/agent/agentUi/middleware.go b/agent/agentUi/middleware.go index 4b30efe1..ab669f06 100644 --- a/agent/agentUi/middleware.go +++ b/agent/agentUi/middleware.go @@ -1,6 +1,7 @@ package agentUi import ( + "github.com/sirupsen/logrus" "io/fs" "net/http" "os" @@ -8,6 +9,8 @@ import ( "strings" ) +const staticPath = "dist" + func Middleware(handler http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if strings.HasPrefix(r.URL.Path, "/v1") { @@ -15,23 +18,13 @@ func Middleware(handler http.Handler) http.Handler { return } - staticPath := "dist" - indexPath := "index.html" + path := filepath.ToSlash(filepath.Join(staticPath, r.URL.Path)) + logrus.Debugf("path = %v", path) - // get the absolute path to prevent directory traversal - path, err := filepath.Abs(r.URL.Path) - if err != nil { - // if we failed to get the absolute path respond with a 400 bad request and stop - http.Error(w, err.Error(), http.StatusBadRequest) - return - } - // prepend the path with the path to the static directory - path = filepath.Join(staticPath, path) - - _, err = FS.Open(path) + f, err := FS.Open(path) if os.IsNotExist(err) { // file does not exist, serve index.gohtml - index, err := FS.ReadFile(filepath.Join(staticPath, indexPath)) + index, err := FS.ReadFile(filepath.ToSlash(filepath.Join(staticPath, "index.html"))) if err != nil { http.Error(w, err.Error(), http.StatusInternalServerError) return @@ -47,6 +40,7 @@ func Middleware(handler http.Handler) http.Handler { http.Error(w, err.Error(), http.StatusInternalServerError) return } + defer func() { _ = f.Close() }() // get the subdirectory of the static dir if statics, err := fs.Sub(FS, staticPath); err == nil { diff --git a/agent/proctree/impl_windows.go b/agent/proctree/impl_windows.go index 2c548a44..6a446fe8 100755 --- a/agent/proctree/impl_windows.go +++ b/agent/proctree/impl_windows.go @@ -3,6 +3,7 @@ package proctree import ( + "github.com/kolesnikovae/go-winjob" "golang.org/x/sys/windows" "os/exec" "sync" diff --git a/agent/proctree/proctree.go b/agent/proctree/proctree.go index 201517e7..506435b0 100755 --- a/agent/proctree/proctree.go +++ b/agent/proctree/proctree.go @@ -2,6 +2,7 @@ package proctree import ( "fmt" + _ "github.com/kolesnikovae/go-winjob" "io" "os/exec" "sync" diff --git a/go.mod b/go.mod index 03b7ca9b..7dfaf28d 100644 --- a/go.mod +++ b/go.mod @@ -28,6 +28,7 @@ require ( github.com/jedib0t/go-pretty/v6 v6.4.3 github.com/jessevdk/go-flags v1.6.1 github.com/jmoiron/sqlx v1.3.5 + github.com/kolesnikovae/go-winjob v1.0.0 github.com/lib/pq v1.10.9 github.com/mattn/go-sqlite3 v1.14.18 github.com/michaelquigley/cf v0.0.13 diff --git a/go.sum b/go.sum index f5bf0595..8959baf8 100644 --- a/go.sum +++ b/go.sum @@ -588,6 +588,8 @@ github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ib github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c= github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM= github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws= +github.com/kolesnikovae/go-winjob v1.0.0 h1:OKEtCHB3sYNAiqNwGDhf08Y6luM7C8mP+42rp1N6SeE= +github.com/kolesnikovae/go-winjob v1.0.0/go.mod h1:k0joOLP3/NBrRmDQjPV2+oN1TPmEWt6arTNtFjVeQuM= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg= @@ -1225,6 +1227,7 @@ golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200826173525-f9321e4c35a6/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=