More bad paths

2026-01-15 15:55:55 +00:00 · 2026-01-15 15:55:55 +00:00 · 392c9b34cd
parent 876e2eeb91
commit 392c9b34cd
1 changed files with 2 additions and 1 deletions
--- a/utils.py
+++ b/utils.py
@ -3967,7 +3967,8 @@ def check_bad_path(path: str):
    """
    path_lower = path.lower()

-    bad_strings = ('..', '/.', '%2e%2e', '%252e%252e')
+    bad_strings = ('..', '/.', '%2e%2e', '%252e%252e',
+                   '/sftp.', '/sftp-')

    # allow /.well-known/...
    if '/.' in path_lower: