You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
But this means that if I have a valid but non safe listed filename我的城市.pmtiles in s3, then I put the lambda proxy in front, it will not work, it will return 404.
We should accept any character in URLs but be careful to avoid path traversal attacks, etc.
In the AWS and Cloudflare proxy implementations we use a regex to parse the URL to a object storage key https://github.com/protomaps/PMTiles/blob/main/serverless/shared/index.ts#L8
This only allows S3-safelisted characters https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html
But this means that if I have a valid but non safe listed filename
我的城市.pmtiles
in s3, then I put the lambda proxy in front, it will not work, it will return 404.We should accept any character in URLs but be careful to avoid path traversal attacks, etc.
This also affects go-pmtiles and thus the GCP and Azure implementations: https://github.com/protomaps/go-pmtiles/blob/main/pmtiles/server.go#L441
The text was updated successfully, but these errors were encountered: