From 76fd0e7880ee7a4098d7742b144ff4a40f77a7c2 Mon Sep 17 00:00:00 2001
From: orignal <i2porignal@yandex.ru>
Date: Mon, 12 Oct 2026 11:13:51 -0400
Subject: [PATCH] verify url path

---
 libi2pd_client/TorrentsRPC.cpp | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/libi2pd_client/TorrentsRPC.cpp b/libi2pd_client/TorrentsRPC.cpp
index 98a28cb7..d1284803 100644
--- a/libi2pd_client/TorrentsRPC.cpp
+++ b/libi2pd_client/TorrentsRPC.cpp
@@ -939,6 +939,28 @@ namespace torrents
 		else
 		{
 			std::filesystem::path urlPath (target);
+			bool isPathValid = false;
+			auto subUrlPath = urlPath.begin ();
+			if (subUrlPath != urlPath.end () && *subUrlPath == "/")
+			{
+				subUrlPath++;
+				if (subUrlPath != urlPath.end ())
+				{
+					auto tunnel = m_Server.GetTunnel (subUrlPath->string () + "/rpc");
+					if (tunnel)
+					{
+						subUrlPath++;
+						if (subUrlPath != urlPath.end ())
+							isPathValid = *subUrlPath == "web";
+					}
+				}
+			}
+			if (!isPathValid)
+			{
+				SendResponse (boost::beast::http::status::forbidden);
+				return;
+			}
+
 			filePath /= urlPath.filename ();
 			std::string ext = urlPath.extension ().string ();
 			boost::to_lower (ext);
@@ -950,8 +972,6 @@ namespace torrents
 				if (isText)
 					contentType += "; charset=utf-8";
 			}
-			if (urlPath.extension () == ".js")
-				contentType = "application/javascript";
 		}
 
 		boost::beast::error_code ec;