╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ web.zig ──────────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯
╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╯
1980 var storage: [token_hex_len]u8 = undefined; 1981 var file_reader = file.reader(self.io, &storage); 1982 file_reader.interface.readSliceAll(out) catch return false; 1983 } 1984 self.dir.deleteFile(self.io, auto_login_name) catch return false; 1985 return true; 1986 } 1987 1988 const auto_login_name = "auto-login"; 1989 1990 // a token is exactly token_hex_len hex chars. validating before using the 1991 // value as a path keeps attacker-supplied cookies from escaping the 1992 // sessions dir (e.g. via "/" or ".." bytes). 1993 fn isToken(token_hex: []const u8) bool { 1994 if (token_hex.len != token_hex_len) return false; 1995 for (token_hex) |c| if (!std.ascii.isHex(c)) return false; 1996 return true; 1997 } 1998 }; 1999