From 7b079ff7a66ea0d7baa12fa16f084f025c1c9fce Mon Sep 17 00:00:00 2001
From: stuebinm
Date: Tue, 16 Nov 2021 21:33:25 +0100
Subject: reject map urls starting with /_/

---
 lib/Properties.hs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/Properties.hs b/lib/Properties.hs
index 90aa3ad..2ef587c 100644
--- a/lib/Properties.hs
+++ b/lib/Properties.hs
@@ -1,4 +1,5 @@
 {-# LANGUAGE LambdaCase        #-}
+{-# LANGUAGE MultiWayIf        #-}
 {-# LANGUAGE NamedFieldPuns    #-}
 {-# LANGUAGE OverloadedStrings #-}
 
@@ -176,9 +177,11 @@ checkLayerProperty p@(Property name _value) = case name of
     "allowApi" -> isForbidden
     "exitUrl" -> do
       forbidEmptyLayer
-      unwrapLink p $ \link -> if "/" `isPrefixOf` link
-        then dependsOn $ MapLink link
-        else unwrapPath link (dependsOn . LocalMap)
+      unwrapLink p $ \link -> if
+        | "/_/" `isPrefixOf` link ->
+          complain "absolute map links (i.e. links starting with '/_/') are disallowed."
+        | "/@/" `isPrefixOf` link -> dependsOn $ MapLink link -- TODO
+        | otherwise -> unwrapPath link (dependsOn . LocalMap)
     "startLayer" -> do
       forbidEmptyLayer
       layer <- askContext
-- 
cgit v1.2.3