Disabling path traversal vulnerability

Originally posted: 2022-02-05 ~ Last updated: 2022-02-12

In recent two days, two gemini servers fixed path traversal vulnerabilities.

First, thanks to Acidus for responsibly disclosing, and int80h for promptly fixing the issue in gemserv:

=> pre-disclosure announcement | Disclosure announcement | gemserv git repository | gemserv on Docker hub

Second, the JAGS-PHP developer Matthias Weiß fixed an issue (pointed out by Tyler Spivey) in the JAGS-PHP server:

=> Announcement | JAGS-PHP github repo

Is it a weekend of fixing path traversal vulnerabilities in gemini clients? Naturally I decided to support this trend and fix the well-known path traversal vulnerability in my simple bash gemini server. So now when it detects a path traversal attempt - it prints its own source code, instead! :D

Update

That was a fun joke, but two days later I removed in and uploaded the code to github. Please refer to the original article on how and where to get the code:

=> Original article announcing the Gemini server written in bash.

End of update

Please feel free everyone to check if you can find any vulnerabilities there!

Also I've added titan support and "donate" ;) button (link, actually) and titan protocol, so now I can edit posts in the same application as where I read them! It's a subject for future posts, but if you manage to find a vulnerability there (or figure out my titan password) - please do let me know!