Path names are used as part of paths in several components: in the
recorder, in the playback server and in every HTTP-based component
(WebRTC, HLS, API). Special characters that allow to escape from the
intended directory are now forbidden in order to prevent directory
traversal attacks.
The API crashed when
- '%path%' is not present in 'recordPath'
- 'all_others' is in 'paths'
- there's at least one recording segment
A recording segment without path is parsed as a segment with an empty
path. This path is then passed to FindPathConf(), that returns an error
in case of empty or invalid paths. This error is not checked for
performance reasons, leading to the crash.
This PR prevents empty or invalid paths from reaching FindPathConf().
* bugfix in recordstore: no segments returned when given a start time earlier than all available segments
* add tests
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
* change from filepath.Walk to filepath.WalkDir
* use filepath.WalkDir in the entire project
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
