fix dir traversal vuln

src/database/fs.rs

@@ -188,16 +188,27 @@ impl Database for Filesystem {
 
     // XXX: slow
     fn by_uid(&self, uid: &str) -> Option<Box<[u8]>> {
-        let target = self.base.join("public").join("by-uid").join(uid);
+        use std::fs;
 
-        File::open(target).ok().and_then(|mut fd| {
+        let path = self.base.join("public").join("by-uid").join(uid);
-            let mut buf = Vec::default();
+
-            if fd.read_to_end(&mut buf).is_ok() {
+        fs::canonicalize(path).ok()
-                Some(buf.into_boxed_slice())
+            .and_then(|p| {
-            } else {
+                if p.starts_with(&self.base) {
-                None
+                    Some(p)
-            }
+                } else {
-        })
+                    None
+                }
+            }).and_then(|p| {
+                File::open(p).ok()
+            }).and_then(|mut fd| {
+                let mut buf = Vec::default();
+                if fd.read_to_end(&mut buf).is_ok() {
+                    Some(buf.into_boxed_slice())
+                } else {
+                    None
+                }
+            })
     }
 }