From fd73f144aafa6b4f3ff9ad8354e87e80e7d5fbb2 Mon Sep 17 00:00:00 2001
From: sigoden <sigoden@gmail.com>
Date: Mon, 29 Jun 2026 19:55:36 +0800
Subject: [PATCH] fix: require path separator boundary when stripping
 --path-prefix (#725)

The resolve_path function used str::strip_prefix which accepted
same-component prefix matches (e.g. prefix "pfx" matched both
"/pfx/file" and "/pfxfile"). Now requires the prefix to be
followed by "/" or be an exact match to serve the root.
---
 src/server.rs |  5 ++++-
 tests/args.rs | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/server.rs b/src/server.rs
index b89076e..17c1a11 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -1439,8 +1439,11 @@ impl Server {
         if path_prefix.is_empty() {
             return Some(new_path);
         }
+        if new_path == path_prefix {
+            return Some(String::new());
+        }
         new_path
-            .strip_prefix(path_prefix.trim_start_matches('/'))
+            .strip_prefix(&format!("{path_prefix}/"))
             .map(|v| v.trim_matches('/').to_string())
     }
 
diff --git a/tests/args.rs b/tests/args.rs
index 91e0eb1..9b7a7c5 100644
--- a/tests/args.rs
+++ b/tests/args.rs
@@ -21,6 +21,24 @@ fn path_prefix_file(#[with(&["--path-prefix", "xyz"])] server: TestServer) -> Re
     Ok(())
 }
 
+#[rstest]
+fn path_prefix_reject_same_component(
+    #[with(&["--path-prefix", "xyz"])] server: TestServer,
+) -> Result<(), Error> {
+    let resp = reqwest::blocking::get(format!("{}xyzpublic.txt", server.url()))?;
+    assert_eq!(resp.status(), 400);
+    Ok(())
+}
+
+#[rstest]
+fn path_prefix_reject_extra_component_text(
+    #[with(&["--path-prefix", "xyz"])] server: TestServer,
+) -> Result<(), Error> {
+    let resp = reqwest::blocking::get(format!("{}xyzevil/public.txt", server.url()))?;
+    assert_eq!(resp.status(), 400);
+    Ok(())
+}
+
 #[rstest]
 fn path_prefix_propfind(
     #[with(&["--path-prefix", "xyz"])] server: TestServer,