diff --git a/storage/filesystem.go b/storage/filesystem.go index 52a4974..6f3a189 100644 --- a/storage/filesystem.go +++ b/storage/filesystem.go @@ -21,7 +21,10 @@ type filesystemBackend struct { path string } -var nilBackend carddav.Backend = (*filesystemBackend)(nil) +var ( + nilBackend carddav.Backend = (*filesystemBackend)(nil) + validFilenameRegex = regexp.MustCompile(`^/[A-Za-z0-9_-]+(.[a-zA-Z]+)?$`) +) func NewFilesystem(path string) (carddav.Backend, error) { info, err := os.Stat(path) @@ -65,8 +68,7 @@ func (b *filesystemBackend) safePath(ctx context.Context, path string) (string, } // We are mapping to local filesystem path, so be conservative about what to accept // TODO this changes once multiple addess books are supported - var valid = regexp.MustCompile(`^/[A-Za-z0-9_-]+(.[a-zA-Z]+)?$`) - if !valid.MatchString(path) { + if !validFilenameRegex.MatchString(path) { return "", fmt.Errorf("invalid request path") } return filepath.Join(basePath, path), nil