diff --git a/spec/std/http/server/handlers/static_file_handler_spec.cr b/spec/std/http/server/handlers/static_file_handler_spec.cr index f4de1cf6ba58..d63629ba5236 100644 --- a/spec/std/http/server/handlers/static_file_handler_spec.cr +++ b/spec/std/http/server/handlers/static_file_handler_spec.cr @@ -124,4 +124,13 @@ describe HTTP::StaticFileHandler do response.status_code.should eq(400) end end + + it "handles invalid redirect path" do + response = handle HTTP::Request.new("GET", "test.txt%0A") + response.status_code.should eq(302) + response.headers["Location"].should eq "/test.txt%0A" + + response = handle HTTP::Request.new("GET", "/test.txt%0A") + response.status_code.should eq(404) + end end diff --git a/src/http/server/handlers/static_file_handler.cr b/src/http/server/handlers/static_file_handler.cr index fdc17bcfc54d..7aa49fb1ac5b 100644 --- a/src/http/server/handlers/static_file_handler.cr +++ b/src/http/server/handlers/static_file_handler.cr @@ -99,7 +99,7 @@ class HTTP::StaticFileHandler private def redirect_to(context, url) context.response.status_code = 302 - url = URI.escape(url) { |b| URI.unreserved?(b) || b != '/' } + url = URI.escape(url) { |byte| URI.unreserved?(byte) || byte.chr == '/' } context.response.headers.add "Location", url end