fileFor method

File? fileFor(List<String> segments)

the file for segments (the decoded request path), or null when the path is not under prefix or is not safe. .., .env and other dot names, empty segments (a//b, a trailing /) and \ are refused, so no file outside root and no hidden file is sent. The one dot name allowed is a .well-known folder at the top of root (ACME challenges, security.txt). Dot names inside it are still refused.

Implementation

File? fileFor(List<String> segments) {
  if (segments.length <= prefix.length) return null;
  for (int i = 0; i < prefix.length; i++) {
    if (segments[i] != prefix[i]) return null;
  }
  List<String> rest = segments.sublist(prefix.length);
  for (int i = 0; i < rest.length; i++) {
    String s = rest[i];
    if (i == 0 && s == '.well-known') continue;
    if (s.isEmpty ||
        s.startsWith('.') ||
        s.contains('/') ||
        s.contains('\\') ||
        s.contains('\x00')) {
      return null;
    }
  }
  String path = p.joinAll(<String>[root, ...rest]);
  return p.isWithin(root, path) ? File(path) : null;
}