Do not allow \ or @ in URL

web/handler.go

@@ -8,6 +8,7 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"regexp"
 	"strings"
 
 	"github.com/markbates/pkger"
@@ -17,6 +18,11 @@ import (
 	"gitlab.crans.org/nounous/ghostream/stream/webrtc"
 )
 
+var (
+	// Precompile regex
+	validPath = regexp.MustCompile("^/[a-z0-9_-]*$")
+)
+
 // Handle WebRTC session description exchange via POST
 func viewerPostHandler(w http.ResponseWriter, r *http.Request) {
 	// Limit response body to 128KB

web/web.go

@@ -7,7 +7,6 @@ import (
 	"log"
 	"net/http"
 	"os"
-	"regexp"
 	"strings"
 
 	"github.com/markbates/pkger"
@@ -42,9 +41,6 @@ var (
 
 	// Preload templates
 	templates *template.Template
-
-	// Precompile regex
-	validPath = regexp.MustCompile("^/[a-z0-9@_\\-]*/?$")
 )
 
 // Load templates with pkger