From d5c75e159473c253a533316a2c0b05e696131459 Mon Sep 17 00:00:00 2001 From: Toby Padilla Date: Tue, 22 Jan 2019 12:32:37 -0600 Subject: [PATCH] Use HTML template for directory listing. Manually espcaping filenames was causing bad paths when the files contained an escaped character. By switching to `html/template`, we can use the automatic escaping which is context appropriate. --- server/dirlist.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/server/dirlist.go b/server/dirlist.go index d4ce546..936d34f 100644 --- a/server/dirlist.go +++ b/server/dirlist.go @@ -1,6 +1,6 @@ package server -import "text/template" +import "html/template" import "fmt" import "os" import "time" @@ -147,7 +147,6 @@ func (this *RanServer) listDir(w http.ResponseWriter, serveAll bool, c *context) if i.IsDir() { name += "/" } - name = html.EscapeString(name) // skip hidden path if !serveAll && strings.HasPrefix(name, ".") {