chore(release): version v0.13.2

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.13.2] - 2022-06-06
+
+### Bug Fixes
+
+- Filename xml escaping
+- Escape path-prefix/url-prefix different
+
 ## [0.13.1] - 2022-06-05
 
 ### Bug Fixes

Cargo.lock

@@ -286,7 +286,7 @@ dependencies = [
 
 [[package]]
 name = "duf"
-version = "0.13.1"
+version = "0.13.2"
 dependencies = [
  "async-walkdir",
  "async_zip",
@@ -313,6 +313,7 @@ dependencies = [
  "tokio-util",
  "urlencoding",
  "uuid",
+ "xml-rs",
 ]
 
 [[package]]
@@ -1368,6 +1369,12 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
 
+[[package]]
+name = "xml-rs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2d7d3948613f75c98fd9328cfdcc45acc4d360655289d0a7d4ec931392200a3"
+
 [[package]]
 name = "xz2"
 version = "0.1.6"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "duf"
-version = "0.13.1"
+version = "0.13.2"
 edition = "2021"
 authors = ["sigoden <sigoden@gmail.com>"]
 description = "Duf is a simple file server."
@@ -35,6 +35,7 @@ md5 = "0.7.0"
 lazy_static = "1.4.0"
 uuid = { version = "1.1.1", features = ["v4", "fast-rng"] }
 urlencoding = "2.1.0"
+xml-rs = "0.8"
 env_logger = { version = "0.9.0", default-features = false, features = ["humantime"] }
 log = "0.4.17"
 

src/args.rs

@@ -143,7 +143,7 @@ impl Args {
         let uri_prefix = if path_prefix.is_empty() {
             "/".to_owned()
         } else {
-            format!("/{}/", encode_uri(&path_prefix))
+            format!("/{}/", &path_prefix)
         };
         let cors = matches.is_present("cors");
         let auth = match matches.value_of("auth") {
@@ -237,8 +237,3 @@ pub fn load_private_key(filename: &str) -> BoxResult<PrivateKey> {
     }
     Ok(PrivateKey(keys[0].to_owned()))
 }
-
-pub fn encode_uri(v: &str) -> String {
-    let parts: Vec<_> = v.split('/').map(urlencoding::encode).collect();
-    parts.join("/")
-}

src/main.rs

@@ -10,7 +10,7 @@ pub type BoxResult<T> = Result<T, Box<dyn std::error::Error>>;
 use std::env;
 use std::io::Write;
 
-use crate::args::{encode_uri, matches, Args};
+use crate::args::{matches, Args};
 use crate::server::serve;
 
 #[tokio::main]

src/server.rs

@@ -1,5 +1,6 @@
 use crate::auth::{generate_www_auth, valid_digest};
-use crate::{encode_uri, Args, BoxResult};
+use crate::{Args, BoxResult};
+use xml::escape::escape_str_pcdata;
 
 use async_walkdir::WalkDir;
 use async_zip::write::{EntryOptions, ZipFileWriter};
@@ -821,9 +822,9 @@ impl PathItem {
 <D:status>HTTP/1.1 200 OK</D:status>
 </D:propstat>
 </D:response>"#,
-                prefix,
+                escape_str_pcdata(prefix),
-                encode_uri(&self.name),
+                escape_str_pcdata(&self.name),
-                urlencoding::encode(&self.base_name),
+                escape_str_pcdata(&self.base_name),
                 mtime
             ),
             PathType::File | PathType::SymlinkFile => format!(
@@ -839,9 +840,9 @@ impl PathItem {
 <D:status>HTTP/1.1 200 OK</D:status>
 </D:propstat>
 </D:response>"#,
-                prefix,
+                escape_str_pcdata(prefix),
-                encode_uri(&self.name),
+                escape_str_pcdata(&self.name),
-                urlencoding::encode(&self.base_name),
+                escape_str_pcdata(&self.base_name),
                 self.size.unwrap_or_default(),
                 mtime
             ),
@@ -974,7 +975,7 @@ fn to_content_range(range: &Range, complete_length: u64) -> Option<ContentRange>
 }
 
 fn print_listening(address: &str, port: u16, prefix: &str, tls: bool) {
-    let prefix = prefix.trim_end_matches('/');
+    let prefix = encode_uri(prefix.trim_end_matches('/'));
     let addrs = retrieve_listening_addrs(address);
     let protocol = if tls { "https" } else { "http" };
     if addrs.len() == 1 {
@@ -1005,3 +1006,8 @@ fn retrieve_listening_addrs(address: &str) -> Vec<String> {
     }
     vec![address.to_owned()]
 }
+
+fn encode_uri(v: &str) -> String {
+    let parts: Vec<_> = v.split('/').map(urlencoding::encode).collect();
+    parts.join("/")
+}