Skip to content

Python-style listing does not escape the path #211

New issue
New issue
Closed
#212
Closed
Python-style listing does not escape the path#211
#212
Labels
Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.

Description

@Mzack9999
Mzack9999
opened on Oct 29, 2026

With -py, the directory listing writes the request path into the page without escaping, so a crafted path changes the page. Running -py together with -sandbox also panics on the first request.

Activity

  1. Mzack9999
    added
    Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.
    on Oct 29, 2026
  2. Mzack9999
    changed the title [-]Python-style listing does not escape the request path, and -py with -sandbox panics[/-] [+]Python-style listing does not escape the path[/+] on Nov 5, 2026
  3. dwisiswant0
    linked a pull request that will close this issueEscape the path in the python-style listing #212on Nov 5, 2026
  4. dwisiswant0
    closed this as completedon Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions