Arbirary file access possible on Windows

[Sriram Melkote]

Hi,

On Windows, it is possible to access arbitrary files by crafting a GET with unescaped backslash characters. Please see below for an example. This was raised in http://www.couchbase.com/issues/browse/MB-7390. I've made a possible fix for this, https://github.com/melkote/mochiweb/commit/ac2bf

Thanks,
Sriram

GET /..............\ff\asubdir\secretfile

HTTP/1.1 200 OK
Server: MochiWeb/1.0 (Any of you quaids got a smint?)
Content-Type: text/plain
Content-Length: 14

Hello
World