Harden static web path and timestamp handling

Author: eldryoth

CHANGELOG.md

@@ -41,6 +41,9 @@ behavior when the change improves security or project direction.
   its complete dedicated process group during shutdown and watchdog recovery.
 - Bound GeoIP database reads to an exact admitted-length allocation with a
   separate growth probe, and validate every publicly constructed `GeoContext`.
+- Make directory-listing timestamp formatting checked and preserve the
+  `SafeRelativePath` invariant through validated incremental components,
+  preventing panic-abort and latent traversal paths in static serving.
 
 ## 1.7.7 - 2026-07-10
 

crates/fluxheim-server/src/native_http1_static_web_resolve.rs

@@ -40,7 +40,9 @@ impl NativeHttp1StaticWeb {
             {
                 return Ok(None);
             }
-            relative.push(segment);
+            if relative.try_push(segment).is_err() {
+                return Ok(None);
+            }
         }
 
         Ok(Some(relative))

crates/fluxheim-web/src/directory_listing.rs

@@ -1,5 +1,5 @@
 use std::path::Path;
-use std::time::SystemTime;
+use std::time::{SystemTime, UNIX_EPOCH};
 
 use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
 
@@ -51,13 +51,12 @@ pub fn render_directory_listing(listing: &DirectoryListing) -> String {
                 .unwrap_or_else(|| "-".to_owned()),
         );
         html.push_str("</td><td>");
-        if let Some(modified) = entry.modified {
-            html.push_str(&html_escape(&format_directory_listing_time(
-                modified,
-                listing.local_time,
-            )));
-        } else {
-            html.push('-');
+        match entry
+            .modified
+            .and_then(|modified| format_directory_listing_time(modified, listing.local_time))
+        {
+            Some(timestamp) => html.push_str(&html_escape(&timestamp)),
+            None => html.push('-'),
         }
         html.push_str("</td></tr>");
     }
@@ -82,13 +81,25 @@ pub fn directory_listing_path(relative: &Path) -> String {
     path
 }
 
-fn format_directory_listing_time(modified: SystemTime, local_time: bool) -> String {
+fn format_directory_listing_time(modified: SystemTime, local_time: bool) -> Option<String> {
+    const MAX_HTTP_DATE_SECONDS: u64 = 253_402_300_799;
+
+    let duration = modified.duration_since(UNIX_EPOCH).ok()?;
+    if duration.as_secs() > MAX_HTTP_DATE_SECONDS {
+        return None;
+    }
     if local_time {
-        let local: chrono::DateTime<chrono::Local> = modified.into();
-        return local.format("%Y-%m-%d %H:%M:%S %z").to_string();
+        let seconds = i64::try_from(duration.as_secs()).ok()?;
+        let utc =
+            chrono::DateTime::<chrono::Utc>::from_timestamp(seconds, duration.subsec_nanos())?;
+        return Some(
+            utc.with_timezone(&chrono::Local)
+                .format("%Y-%m-%d %H:%M:%S %z")
+                .to_string(),
+        );
     }
 
-    httpdate::fmt_http_date(modified)
+    Some(httpdate::fmt_http_date(modified))
 }
 
 fn html_escape(value: &str) -> String {

crates/fluxheim-web/src/lib.rs

@@ -4,7 +4,7 @@
     deny(clippy::expect_used, clippy::panic, clippy::unwrap_used)
 )]
 
-use std::ffi::OsString;
+use std::ffi::{OsStr, OsString};
 use std::io;
 use std::path::{Path, PathBuf};
 use std::time::SystemTime;
@@ -70,9 +70,30 @@ pub struct SafeRelativePath {
     components: Vec<OsString>,
 }
 
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub struct InvalidPathComponent;
+
+impl std::fmt::Display for InvalidPathComponent {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("path component must be one non-empty normal component")
+    }
+}
+
+impl std::error::Error for InvalidPathComponent {}
+
 impl SafeRelativePath {
-    pub fn push(&mut self, component: &str) {
-        self.components.push(OsString::from(component));
+    pub fn try_push(&mut self, component: &str) -> Result<(), InvalidPathComponent> {
+        if component.contains('\0') {
+            return Err(InvalidPathComponent);
+        }
+        let mut components = Path::new(component).components();
+        match (components.next(), components.next()) {
+            (Some(std::path::Component::Normal(value)), None) if value == OsStr::new(component) => {
+                self.components.push(value.to_os_string());
+                Ok(())
+            }
+            _ => Err(InvalidPathComponent),
+        }
     }
 
     pub fn as_path(&self) -> PathBuf {

crates/fluxheim-web/src/web_tests.rs

@@ -1,5 +1,5 @@
 use std::path::Path;
-use std::time::UNIX_EPOCH;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use fluxheim_common::test_support::{safe_child_path, unique_temp_path};
 
@@ -51,13 +51,80 @@ fn directory_listing_local_time_uses_local_timestamp_shape() {
     assert!(!html.contains("GMT"));
 }
 
+#[test]
+fn directory_listing_rejects_pre_epoch_timestamps_without_panicking() {
+    let modified = UNIX_EPOCH
+        .checked_sub(Duration::from_secs(1))
+        .expect("test platform should represent a pre-epoch timestamp");
+
+    for local_time in [false, true] {
+        let html = render_listing_with_timestamp(modified, local_time);
+        assert!(html.contains("<td>1</td><td>-</td>"), "{html}");
+    }
+}
+
+#[test]
+fn directory_listing_rejects_post_year_9999_timestamps_without_panicking() {
+    let modified = UNIX_EPOCH
+        .checked_add(Duration::from_secs(253_402_300_800))
+        .expect("test platform should represent a post-year-9999 timestamp");
+
+    for local_time in [false, true] {
+        let html = render_listing_with_timestamp(modified, local_time);
+        assert!(html.contains("<td>1</td><td>-</td>"), "{html}");
+    }
+}
+
+fn render_listing_with_timestamp(modified: SystemTime, local_time: bool) -> String {
+    render_directory_listing(&DirectoryListing {
+        path: "/".to_owned(),
+        entries: vec![DirectoryEntry {
+            name: "timestamp.txt".to_owned(),
+            is_dir: false,
+            size: Some(1),
+            modified: Some(modified),
+        }],
+        local_time,
+    })
+}
+
 #[test]
 fn safe_relative_path_rejects_non_normal_components() {
     assert!(SafeRelativePath::from_path(Path::new("assets/app.css")).is_some());
     assert!(SafeRelativePath::from_path(Path::new("../secret")).is_none());
     assert!(SafeRelativePath::from_path(Path::new("/absolute")).is_none());
 }
 
+#[test]
+fn safe_relative_path_try_push_preserves_component_invariant() {
+    let mut path = SafeRelativePath::default();
+    path.try_push("assets")
+        .expect("normal component should pass");
+
+    for invalid in [
+        "",
+        ".",
+        "..",
+        "../secret",
+        "a/b",
+        "/absolute",
+        "trailing/",
+        "nul\0byte",
+    ] {
+        assert!(path.try_push(invalid).is_err(), "accepted {invalid:?}");
+    }
+    assert_eq!(path.as_path(), Path::new("assets"));
+}
+
+#[cfg(windows)]
+#[test]
+fn safe_relative_path_try_push_rejects_windows_separators() {
+    let mut path = SafeRelativePath::default();
+    assert!(path.try_push(r"parent\child").is_err());
+    assert!(path.try_push(r"C:\absolute").is_err());
+    assert_eq!(path.as_path(), Path::new(""));
+}
+
 #[test]
 fn safe_relative_path_detects_prefixed_components() {
     let path = SafeRelativePath::from_path(Path::new(".well-known/acme-challenge"))

release-notes/RELEASE_NOTES_1.7.8.md

@@ -68,6 +68,12 @@ general-purpose WASI application hosting.
   observe malformed security state.
 - Replace inherited managed PHP-FPM `PATH` handling with a fixed allowlisted
   search path after clearing the child environment.
+- Render unavailable directory-listing timestamps as `-` after checked epoch
+  and year-9999 bounds, preventing attacker-influenced file metadata from
+  reaching panic-prone timestamp formatters in release builds.
+- Replace unchecked `SafeRelativePath` component insertion with a validating
+  single-normal-component API so the public type preserves its traversal-safety
+  invariant for current and future static-serving callers.
 
 ## Validation
 

src/web.rs

@@ -157,7 +157,9 @@ impl StaticFileServer {
                 return Ok(None);
             }
 
-            relative.push(segment);
+            if relative.try_push(segment).is_err() {
+                return Ok(None);
+            }
         }
 
         Ok(Some(relative))