reject map urls starting with /_/

1 files changed, 6 insertions, 3 deletions

diff --git a/lib/Properties.hs b/lib/Properties.hs
index 90aa3ad..2ef587c 100644
--- a/lib/Properties.hs
+++ b/lib/Properties.hs
@@ -1,4 +1,5 @@
 {-# LANGUAGE LambdaCase        #-}
+{-# LANGUAGE MultiWayIf        #-}
 {-# LANGUAGE NamedFieldPuns    #-}
 {-# LANGUAGE OverloadedStrings #-}
 
@@ -176,9 +177,11 @@ checkLayerProperty p@(Property name _value) = case name of
     "allowApi" -> isForbidden
     "exitUrl" -> do
       forbidEmptyLayer
-      unwrapLink p $ \link -> if "/" `isPrefixOf` link
-        then dependsOn $ MapLink link
-        else unwrapPath link (dependsOn . LocalMap)
+      unwrapLink p $ \link -> if
+        | "/_/" `isPrefixOf` link ->
+          complain "absolute map links (i.e. links starting with '/_/') are disallowed."
+        | "/@/" `isPrefixOf` link -> dependsOn $ MapLink link -- TODO
+        | otherwise -> unwrapPath link (dependsOn . LocalMap)
     "startLayer" -> do
       forbidEmptyLayer
       layer <- askContext