Clojurians Log v2

Hmm; seems like maybe it's not vulnerable? I'm not entirely sure. While path traversal segments work fine, it seems however like it won't go outside the directory specified by the file handler.

I guess you are referring to reitit.ring/create-file-handler: https://github.com/metosin/reitit/blob/master/modules/reitit-ring/src/reitit/ring.cljc#L310C10-L310C29 It is built on top of ring.util.response/file-response: https://github.com/ring-clojure/ring/blob/1.15.4/ring-core/src/ring/util/response.clj#L148 which has a check to either only allow files within the root folder, or if allowing symlinks, it will not allow any ...