Aug 28, 2025 · Aug 28, 2025
diff --git a/site/site.go b/site/site.go
 }

 func (b *binMetadataCache) getMetadata(name string) (binMetadata, error) {
 // Reject any invalid or non-basename paths before touching the filesystem.
 if name == "" ||
 name == "." ||
 strings.Contains(name, "/") ||
 strings.Contains(name, "\\") ||
 !fs.ValidPath(name) ||
 path.Base(name) != name {
 return binMetadata{}, os.ErrNotExist
 }

 b.mut.RLock()
 metadata, ok := b.metadata[name]
 b.mut.RUnlock()
 b.sem <- struct{}{}
 defer func() { <-b.sem }()

 // Reject any invalid or non-basename paths before touching the filesystem.
 if name == "" ||
 name == "." ||
 strings.Contains(name, "/") ||
 strings.Contains(name, "\\") ||
 !fs.ValidPath(name) ||
 path.Base(name) != name {
 return binMetadata{}, os.ErrNotExist
 }

 f, err := b.binFS.Open(name)
 if err != nil {
 return binMetadata{}, err
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1018,16 +1018,6 @@ func newBinMetadataCache(binFS http.FileSystem, binSha1Hashes map[string]string)
		}

		func (b *binMetadataCache) getMetadata(name string) (binMetadata, error) {
		// Reject any invalid or non-basename paths before touching the filesystem.
		if name == "" \|\|
		name == "." \|\|
		strings.Contains(name, "/") \|\|
		strings.Contains(name, "\\") \|\|
		!fs.ValidPath(name) \|\|
		path.Base(name) != name {
		return binMetadata{}, os.ErrNotExist
		}

		b.mut.RLock()
		metadata, ok := b.metadata[name]
		b.mut.RUnlock()
Expand All		@@ -1040,6 +1030,16 @@ func (b *binMetadataCache) getMetadata(name string) (binMetadata, error) {
		b.sem <- struct{}{}
		defer func() { <-b.sem }()

		// Reject any invalid or non-basename paths before touching the filesystem.
		if name == "" \|\|
		name == "." \|\|
		strings.Contains(name, "/") \|\|
		strings.Contains(name, "\\") \|\|
		!fs.ValidPath(name) \|\|
		path.Base(name) != name {
		return binMetadata{}, os.ErrNotExist
		}

		f, err := b.binFS.Open(name)
		if err != nil {
		return binMetadata{}, err
Expand Down