wip

internal/webdav/handler.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
 
 	"github.com/yourusername/caldav-server/internal/auth"
@@ -12,9 +13,19 @@ import (
 	xwebdav "golang.org/x/net/webdav"
 )
 
+// sanitize removes path-traversal characters from a path segment.
+func sanitize(s string) string {
+	s = filepath.Base(s)
+	s = strings.ReplaceAll(s, "..", "")
+	if s == "." || s == "" {
+		return "_"
+	}
+	return s
+}
+
 // NewHandler returns an http.Handler that provides standard WebDAV file access,
 // mounted at the fixed URL /files/ for every user and rooted at
-// dataDir/files/<username>/ on disk. The URL is the same for all users —
+// dataDir/<username>/col/files/ on disk. The URL is the same for all users —
 // which user's directory is served is resolved from the Basic Auth identity
 // in the request context, not from the URL.
 //
@@ -38,7 +49,7 @@ func NewHandler(cfg *config.Config, dataDir string, logger *slog.Logger) http.Ha
 		h, ok := handlers[p.Username]
 		if !ok {
 			username := p.Username
-			userDir := filepath.Join(dataDir, "files", username)
+			userDir := filepath.Join(dataDir, sanitize(username), "col", "files")
 			if err := os.MkdirAll(userDir, 0o755); err != nil {
 				mu.Unlock()
 				logger.Error("creating user WebDAV dir", "user", username, "error", err)